← Back to pick.me

Privacy Policy

1. Who we are

pick.me is an AI-first recruitment platform operated by Archie Recruitment (Artur Seredziuk, sole proprietor, Poland). Outsor is the partner-portal surface of the same platform. Throughout this Privacy Policy we refer to both as "we", "us", or "the Service".

Contact for privacy matters: info@archie-recruitment.com.

2. What this policy covers

This policy explains how we process personal data when you (a) sign up to or use the Service, (b) appear in the Service as a candidate added by a recruiter or partner, or (c) interact with our public marketing site.

The Service has three categories of users:

• Candidates — people seeking employment who create an account, upload a CV, or are added by an agency.
• Recruiters — staff of an agency using pick.me as their ATS.
• Partners — outsourcing agencies using Outsor to submit candidates to a host agency.

3. Controller vs processor

For data you place in your tenant (candidates you add, files you upload, notes you write), you (your agency or partner company) act as the data controller and we act as the data processor. Our role and obligations as processor are governed by our Data Processing Agreement (DPA), which is offered to every B2B customer.

For data we collect directly from you to operate the Service (account email, sign-in events, billing info), we act as the data controller.

4. What personal data we process

4.1 Account data (controller: us)

• Name, email address, password hash, role (candidate / recruiter / partner)
• Company name, company role, company size, website (recruiters and partners)
• Sign-in events, IP address (audit log), user-agent string
• Aggregate in-app engagement time (seconds the app is open and active) — stored only as daily and total counts to understand usage and improve the product; not a detailed activity log
• Two-factor authentication enrollment status and TOTP secret (encrypted at rest)
• Consent records — every acceptance or refusal of our policies and per-candidate sharing

4.2 Candidate profile data (controller: the agency)

• Name, email, phone number, city, professional title
• CV file (PDF, DOCX, image)
• Skills, experience, structured notes (availability, language level, expected rate, etc.)
• Voice and video self-presentations, only if the candidate explicitly opts in
• Application history, pipeline status, recruiter notes
• AI-generated CV analysis and translations (derivative data)

4.3 Files attached by the agency or partner (controller: the agency)

• Certificates, work photos, references, identity copies and similar documents uploaded under the candidate's record
• Folder names and free-text labels chosen by the uploader

4.4 Sensitive categories

We do not require or solicit special categories of personal data (health, race, religion, sexual orientation, etc.) and we ask agencies not to upload such data unless strictly necessary, in which case they remain the controller and are responsible for the corresponding legal basis.

5. Sources of the data

Personal data reaches the Service from:

• You, when you sign up, complete a profile, or upload files;
• Agencies or partners that add a candidate manually or import a CV;
• Anthropic Claude AI (data we send for CV analysis is returned as derivative text); and
• Public job-board pages, where unauthenticated visitors can apply.

6. Why we process (legal basis)

Purpose	Legal basis (GDPR Art. 6)
Run the Service for paying customers	(b) performance of a contract
Present candidates to clients	(a) explicit consent recorded per presentation
Account security, audit, fraud prevention	(f) legitimate interest
Send service emails (security, billing)	(b) performance of a contract
Comply with tax and corporate law	(c) legal obligation

7. Who can see your data

7.1 Inside the platform

Data is strictly tenant-isolated. A user belonging to Agency A cannot read records, files or notes belonging to Agency B. Partners can see (a) jobs explicitly shared with them and (b) the status of submissions they themselves made.

Candidates only see data tied to their own account.

7.2 Outside the platform

We rely on a small list of sub-processors:

Sub-processor	Role	Region
Google Cloud / Firebase	Hosting, database, storage, authentication	EU (multi-region)
Anthropic PBC (Claude API)	AI parsing, analysis and translation of CVs	US (Standard Contractual Clauses)
Postmark / SendGrid (planned)	Transactional email delivery	EU

Where a sub-processor is outside the EU/EEA, we transfer data under European Commission Standard Contractual Clauses (SCCs) and only when strictly necessary for the feature. We do not sell or rent your data to anyone, ever.

8. International transfers

Hosting is in the EU. AI processing (Anthropic Claude) is in the United States and currently relies on SCCs. We send the minimum data needed (the CV file plus the job title) and never store derivative analyses outside our EU database.

9. How long we keep your data

Data type	Retention
Active user account	For as long as the account exists, plus 30 days after deletion
Candidate profile added by an agency	Controlled by the agency; we retain while their tenant is active
Audit log of destructive actions	5 years (or longer if required by law)
Consent records	5 years after the consent has lapsed
Billing and tax records	5 years from the end of the fiscal year
Daily database backups	30 days rolling, then deleted

10. Your rights under GDPR

You can ask us at any time to:

• Access the personal data we hold about you (Art. 15).
• Rectify incorrect or incomplete data (Art. 16).
• Erase your data ("right to be forgotten", Art. 17), subject to legal retention obligations.
• Restrict processing while a dispute is resolved (Art. 18).
• Receive your data in a portable format (Art. 20).
• Object to processing based on legitimate interests (Art. 21).
• Withdraw consent you previously gave (the withdrawal does not affect lawfulness of past processing).
• Lodge a complaint with your national data protection authority.

Email info@archie-recruitment.com to exercise any of these rights. We respond within 30 days.

11. Security measures

A short technical summary (see the in-app Safe House panel for the live version):

• HTTPS / TLS in transit; AES-256 encryption at rest.
• Strict tenant isolation in Firestore + Storage rules.
• File listing disabled; download URLs include random tokens.
• Server-side per-file size limits and per-upload tenant validator that deletes unauthorized files.
• Per-user and per-company rate limits on AI endpoints.
• Two-factor authentication available for recruiter accounts.
• Immutable audit log of destructive actions.
• Daily database backups + Firestore Point-in-Time Recovery.
• Default-deny security rules everywhere.

12. Cookies and similar technologies

We use only first-party, strictly-necessary browser storage (your sign-in session, theme preference, "last seen" markers). We do not use third-party analytics, advertising trackers, or cross-site cookies. A one-time banner informs you of this on first visit.

13. Children

The Service is not intended for children under 16. We do not knowingly collect data from anyone under that age. If you believe we hold data about a minor, contact us and we will delete it.

14. Automated decision-making

We use Claude AI to analyse CVs and generate screening reports. These analyses are advisory only — they do not by themselves decide whether a candidate is presented to a client. A human recruiter reviews and approves every presentation.

15. Changes to this policy

We will notify users by in-app banner and email at least 30 days before any material change. Your consent records reference the version of the policy that was in force at the time you accepted, so you can always verify which version applied to you.

16. Contact

Privacy questions and rights requests: info@archie-recruitment.com

If you are an EU resident and prefer to contact your supervisory authority, you can find the relevant authority at edpb.europa.eu.