VRS Recruit Privacy Policy

Information we collect

• Account and authentication details, including name, work email, and security events.
• Recruitment records such as CVs, applications, interview notes, assessments, communications, and hiring decisions.
• Workspace content supplied by customers and authorized workspace members.
• Technical and usage information needed for security, reliability, and support.

How we use information

• Provide, secure, maintain, and support VRS Recruit.
• Authenticate users, enforce permissions, prevent abuse, and investigate incidents.
• Operate recruitment workflows and communicate about applications, interviews, and workspace activity.
• Meet contractual, legal, audit, and record-retention obligations.

We do not sell personal information or use workspace data for advertising.

Workspace responsibility

The organization controlling a workspace generally decides what customer or candidate data is processed there, who may access it, and how long it is needed. We process that workspace data to provide the service and may direct a request to the relevant organization when it is the responsible controller.

Connected services and Google user data

When you connect an external account, we access only the data covered by the permissions you grant and only to provide the feature you requested. You can disconnect an integration to stop future access. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Service providers and international processing

We use infrastructure, communications, authentication, storage, analytics, and AI providers to operate the service. Providers receive only the access needed for their role and are subject to contractual and security controls. Processing locations depend on the enabled service and are disclosed during onboarding where required.

Our hosting and error monitoring are processed in the European Union, and product analytics are stored in the European Union. Some providers operate from, or route through, countries outside the EEA; where that happens we rely on the transfer safeguards in our agreement with that provider, such as the European Commission’s standard contractual clauses. Our current sub-processors are listed publicly, and we update that page before a new sub-processor begins processing workspace data.

Retention and security

We retain information for the workspace purpose, customer contract, security need, and legal obligations that apply. The periods below apply unless a longer period is required by law or a legal hold is in place.

• Deleted files — 30 days. Files you delete stay in the trash so they can be restored, then are permanently removed along with their stored copies.
• Deleted records — 30 days. Records deleted in the product are withdrawn from use immediately and erased after this window, unless a legal hold applies.
• Audit and security logs — 24 months. Append-only records of access and changes, kept so we can investigate security and support issues.
• Product analytics events — 12 months. Pseudonymised usage events. See the product analytics section for what is collected.
• Encrypted backups — 30 days. Backups roll off on this cycle, so deleted data can persist in a backup until its cycle completes.

The organization controlling a workspace may set shorter periods, and can request erasure at any time. We use tenant-scoped access, encrypted transport, role-aware controls, and operational logging. No system can guarantee absolute security; report suspected misuse promptly through the contact channel below.

Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, objection, or export of personal information. Some requests must be handled by the organization that controls the relevant workspace. We may retain information required for security, disputes, or legal compliance.

Contact and changes

Submit privacy questions or requests through VRS contact page. Do not include passwords, private keys, or unnecessary sensitive information. Material policy changes will be reflected here with a new updated date.