Privacy Policy
This Privacy Policy explains how personal data is processed in connection with the ReCo product, sold and provided by Recruiter Companion Labs PSA ("Company"). It covers two distinct contexts: (1) how we process data about recruiters who use ReCo, and (2) how candidate data flows through ReCo when recruiters use the product.
1. Who is the data controller
1.1 Recruiter data.
For data relating to recruiters ("ReCo Users") — including registration, billing, and account data — the data controller is Recruiter Companion Labs PSA, with its registered office at ul. Pilotów 2a/13, 31-462 Kraków, Poland (EU). Contact: [email protected]. Recruiter Companion Labs PSA also acts as data controller for usage metrics and product analytics data (see Section 4 — usage log data), which are processed for its own purposes of billing, service monitoring, and product improvement.
1.2 Candidate data.
When a recruiter uses ReCo to process personal data of candidates (including transcripts of interviews, CV/resume content, job descriptions, notes, and chat messages), the recruiter acts as the primary data controller of that candidate data. Recruiter Companion Labs PSA acts as a data processor on behalf of the recruiter, to the extent that candidate data is transmitted through the ReCo platform for AI-assisted processing (see Section 5 below). The legal basis for this processing by Recruiter Companion Labs PSA is the performance of the contract with the recruiter (Article 6(1)(b) GDPR).
Finished reports and locally stored files remain on the recruiter's device. Recruiter Companion Labs PSA does not retain access to those files.
2. Responsibility for Data Processing
ReCo is a tool that enables recruiters to manage and document their recruitment workflow. However, certain obligations lie with the recruiter directly, under both the GDPR and the EU AI Act.
2.1 GDPR
As the primary controller of candidate data, the recruiter is responsible for:
- Collecting, processing, and storing candidate data lawfully.
- Ensuring an appropriate legal basis for each processing purpose under Article 6 GDPR.
- Informing candidates of their rights and how their data is processed.
- Implementing appropriate technical and organizational security measures.
- Complying with all applicable data protection regulations, including the GDPR.
ReCo provides in-product reminders to recruiters about their data protection obligations (for example, when recording transcripts or uploading CVs). These reminders do not transfer legal responsibility to Recruiter Companion Labs PSA.
Recruiters are also required under our Terms & Conditions to inform candidates about AI-assisted data processing prior to any interview conducted using ReCo. A ready-to-use consent template is provided there for recruiters to copy and share with candidates.
2.2 EU AI Act
In the context of the EU AI Act (Regulation (EU) 2024/1689), Recruiter Companion Labs PSA acts as a provider of an AI-assisted tool. Recruiters who use ReCo to conduct interviews and generate candidate assessments act as deployers of that tool within the meaning of the AI Act. Recruitment-related AI systems may fall within the scope of high-risk AI systems under Annex III of the AI Act.
Deployer obligations under the AI Act are addressed in our Terms & Conditions.
3. Personal Data Processed by Recruiter Companion Labs PSA
3.1 Recruiter account data
We collect and process the following data about recruiters who register and use ReCo:
- Name and email address
- Billing and payment information
- Usage data and product interaction logs
- Communications with our support team
Legal basis: performance of a contract (Article 6(1)(b) GDPR) and legitimate interests (Article 6(1)(f) GDPR).
3.2 Candidate data processed through the platform
ReCo produces interview transcripts in two different ways, depending on where the conversation takes place.
For online meetings, ReCo captures text-based closed captions generated by the video conferencing platform (Google Meet or Microsoft Teams). No audio or video is recorded, captured, or transmitted by ReCo during online meetings .
For conversations that take place in a room — an in-person interview, or a phone call — ReCo transcribes the audio picked up by the computer's microphone, as described in Section 3.3 below.
When recruiters use ReCo's AI-assisted features, the following categories of candidate data may be transmitted through the ReCo platform to OpenAI's API for processing:
- Interview transcripts
- CV/resume content (including anonymized/blinded versions)
- Job description content
- Recruiter notes
- Chat messages within ReCo
This data is processed solely to generate AI-assisted outputs (such as candidate reports) on behalf of the recruiter. Recruiter Companion Labs PSA does not use this data for its own purposes, does not sell it, and does not retain it beyond what is technically necessary for the processing operation.
Speaker names never reach the AI: a transcript sent for AI-assisted processing carries roles only, "Recruiter" and "Candidate". What was said is transmitted as spoken, so the recruiter decides what goes — transcription can be stopped and started again, individual passages can be edited, and a transcript can be deleted before anything is sent.
CV/resume blinding works on the same principle: personal identifiers in a CV are detected automatically and removed before it is sent for AI-assisted processing, and the recruiter can review the result and correct it by hand if necessary (see Section 5 — Hugging Face).
3.3 In-person meetings and phone calls
ReCo can transcribe a conversation taking place in a room, using the microphone of the recruiter's computer. This covers in-person interviews and phone calls, where the recruiter dials from their own phone and puts it on speakerphone beside the computer. ReCo does not place the call, does not receive or store any phone number, and is not a party to it: what is captured is the sound in the room, not a telephone connection.
Transcription never runs on its own: it is available only on accounts where the feature has been enabled at the user's request, and the recruiter starts and ends it. ReCo uses the microphone only, never a camera.
3.3.1 What is transmitted and what is kept
The audio is streamed from the recruiter's browser to Speechmatics, our speech-to-text provider (see Section 5), over an encrypted connection to its servers in the European Union. Speechmatics receives nothing beyond the audio and the settings needed to recognise speech: no names, no account identifier, and nothing about the subject of the conversation. Everything audible in the room while transcription is running is nonetheless transmitted as audio.
The audio is used only to produce text. It is not saved at any point, either by us or by Speechmatics, and no recording is created.
The resulting text is stored on the recruiter's own device, and leaves it only if the recruiter asks for AI-assisted processing (see Section 3.2). Speakers are told apart but not identified, and no lasting voiceprint is created.
The audio never passes through our servers, and we have no means of intercepting or retaining it. We record only what billing and fair use require: which account started a transcription, when, and how long it ran (see Section 3.1 of our Terms & Conditions).
3.3.2 Other people in the room
A microphone in a room captures whatever is audible, which may include people who are not taking part in the conversation, or background conversation in a shared space.
The recruiter, or the recruiter's employer, is the controller of that data, on the same basis as Sections 1.2 and 2.1. The recruiter decides when to start transcription. Choosing a space where other people are not captured, or informing them that they may be, rests with the recruiter, as does holding a valid legal basis and obtaining the consent of all parties where the applicable law requires it.
ReCo transmits speech as spoken and has no means of filtering, redacting or assessing what is said while a conversation is being transcribed. What ends up in a transcript therefore depends on how the conversation is conducted, which rests with the recruiter: keeping questions within what applicable recruitment and employment law permits, not soliciting special categories of data, and deciding whether to continue, stop or delete where a conversation moves into information that should not have been recorded. This obligation is set out in Section 5.5 of our Terms & Conditions.
To support the recruiter in meeting these obligations, ReCo shows a reminder to obtain that consent the first time transcription starts in a session, and provides the means to stop transcription, to edit individual passages and to delete a transcript. Obtaining and documenting consent remains the recruiter's responsibility.
4. Data Retention
Recruiter account data is retained for the duration of the active account and for up to 3 years after account termination, as required for legal and billing purposes.
Candidate data transmitted via the API is processed transiently. OpenAI retains API input data for a maximum of 30 days before deletion, in accordance with their data retention policy. Recruiter Companion Labs PSA does not maintain a separate copy of this data.
Audio from in-person meetings and phone calls. This is never stored by ReCo, and never reaches our servers (Section 3.3), so there is nothing on our side to retain or delete. Speechmatics does not store audio, transcripts, or configuration data for its real-time service (see Section 5).
Transcripts and reports. These remain on the recruiter's device until the recruiter deletes them, and are subject to the recruiter's own retention policies.
Usage log data (including user identifier, feature usage, AI token consumption, and associated costs) is retained for up to 3 years on the ReCo server. This data contains no transcript, CV, or candidate content — only technical metrics used for billing and service monitoring purposes.
5. Sub-processors and Third-Party Services
Recruiter Companion Labs PSA uses the following sub-processors in connection with the ReCo service:
OpenAI Ireland Ltd — AI text generation via API. Candidate data (transcripts, CV content, notes, chat) is transmitted to OpenAI for processing. OpenAI acts as a sub-processor under a Data Processing Addendum (DPA) in accordance with Article 28 GDPR. OpenAI does not use API data to train its models. Data is deleted within 30 days. See: openai.com/policies/data-processing-addendum
Cantab Research Limited (trading as "Speechmatics") — Real-time speech-to-text. Where a recruiter transcribes an in-person meeting or a phone call (Section 3.3), the audio captured by the computer's microphone is streamed directly from the recruiter's browser to Speechmatics and converted into text. Speechmatics receives the audio and the recognition configuration only; it receives no names, no account identifier, and no other candidate or recruiter data. Speechmatics acts as a sub-processor: it processes this data only on the recruiter's instructions, passed on by Recruiter Companion Labs PSA, under a data processing agreement in accordance with Article 28 GDPR. Speechmatics does not store audio, transcripts, or configuration data for its real-time service, and does not use real-time audio to improve its models. Speechmatics may involve its own group companies in providing and supporting the service, under the same contractual protections (see Section 6). Registered office: One Cambridge Square, Milton Avenue, Cambridge, CB4 0AE, United Kingdom. See: speechmatics.com/legal/privacy-policy, docs.speechmatics.com/speech-to-text/realtime/limits
Auth0 (by Okta) — Identity and access management. Auth0 stores recruiter account data including email address, name, user role, and subscription status. No candidate data is processed by Auth0. Data is processed in EU region servers. See: auth0.com/privacy
Stripe, Inc. — Payment processing. Stripe handles subscription payments and stores payment card data. The ReCo server never receives or stores payment card details. Stripe does not receive any candidate data. See: stripe.com/privacy
Technology providers (no candidate or recruiter data transferred)
Hugging Face, Inc.— NLP model hosting. The ReCo CV blinding feature uses a named entity recognition (NER) model provided by Hugging Face. The model is downloaded once to the user's device and runs entirely locally (via WebAssembly). No candidate or recruiter data is transmitted to Hugging Face at any point.
Additional sub-processors may be engaged (e.g. infrastructure or operational services). An up-to-date list is available on request at [email protected]. Recruiter Companion Labs PSA will inform recruiters in advance of any intended addition or replacement of a sub-processor, and recruiters may object to such a change. If an objection cannot be resolved, either party may terminate the affected services as set out in our Terms & Conditions.
If the recruiter independently chooses to use third-party services in connection with candidate data, the recruiter is solely responsible for ensuring compliance with applicable data protection law.
6. International Data Transfers
OpenAI Ireland Ltd. is the contracting entity for EEA-based customers. To the extent that candidate data is transferred to OpenAI's infrastructure outside the EEA, such transfers are governed by Standard Contractual Clauses (SCCs) adopted by the European Commission, as incorporated into OpenAI's DPA.
Cantab Research Limited (trading as "Speechmatics") is established in the United Kingdom. ReCo directs microphone audio to Speechmatics' servers in the European Union, but as a UK-established processor Speechmatics may access that data from the United Kingdom; such transfers are covered by the adequacy decision adopted by the European Commission in respect of the United Kingdom. Speechmatics may also involve its own group companies in providing and supporting the service, including Speechmatics (USA) Inc. Transfers beyond the EEA and the United Kingdom are covered by our data processing agreement with Speechmatics: by the Standard Contractual Clauses adopted by the European Commission for transfers within the Speechmatics group, and, for Speechmatics' own sub-processors, by contractual terms containing clauses equivalent to those Clauses. Speechmatics has appointed The DPO Centre Europe Ltd (Alexandra House, 3 Ballsbridge Park, Dublin, D04 C7H2, Ireland) as its representative in the European Union under Article 27 GDPR.
7. Data Security
Recruiter Companion Labs PSA implements appropriate technical and organizational measures to protect data processed through the ReCo platform, including encrypted data transmission (TLS) and access controls.
Recruiters are responsible for the security of data stored on their own devices and for any third-party services they independently connect to ReCo.
8. Rights of Data Subjects
Candidates whose data is processed through ReCo should direct any requests to exercise their rights (access, rectification, erasure, portability, objection) to the recruiter, who is the primary data controller of that data.
Recruiters who wish to exercise their rights in relation to their own account data held by Recruiter Companion Labs PSA may contact us at [email protected].
You also have the right to lodge a complaint with the competent supervisory authority (in Poland: the President of the Personal Data Protection Office, UODO).
9. Cookies and Analytics
The ReCo website and application may use cookies and similar tracking technologies. We use the following:
Essential cookies — required for the service to function (e.g. session management, authentication). These cannot be disabled.
Analytics cookies — we collect data about how users interact with the ReCo website and application (e.g. pages visited, features used, session duration) in order to improve the product. No candidate personal data is included in analytics tracking.
On the ReCo marketing website (usereco.io) these technologies are provided by the following third parties. None of them is used inside the ReCo application, and none of them receives interview transcripts, CV content or any other candidate data.
Google Analytics (Google Ireland Limited) — measures how the website is used: pages viewed, referring source, approximate location derived from IP address, device and browser, and actions such as clicking through to a trial or a demo. We use it to understand which pages and messages work, and to decide what to publish next.
Apollo.io (Apollo.io, Inc.) — a business-to-business visitor identification service. It uses the visitor's IP address and browsing signals to identify the organisation a visit is likely to have come from, and matches it against Apollo's own business contact database. We use it to see which companies show interest in ReCo, so that our outreach goes to organisations that are already looking at us rather than to cold lists. Apollo.io acts as an independent controller in respect of the data it holds in that database; see apollo.io/privacy-policy.
Endorsely — referral and affiliate attribution. It records that a visit arrived through a particular partner or referral link, so that referrals can be credited correctly. It is not used to build a profile of the visitor.
You may disable non-essential cookies through your browser settings, and you can opt out of Google Analytics using Google's browser add-on. Note that disabling cookies may affect the functionality of the service.
10. Changes to This Privacy Policy
Recruiter Companion Labs PSA may update this Privacy Policy periodically. The updated version will be posted with a revised date.
Where an update materially affects the processing of recruiter or candidate data, recruiters are asked to accept the updated Privacy Policy in the ReCo application before continuing to use the service.
11. Contact
Recruiter Companion Labs PSA
ul. Pilotów 2a/13, 31-462 Kraków, Poland (EU)
Email: [email protected]