GrooveCVSign In

Privacy Policy

Version v2 · effective May 25, 2026

1. Who we are and what this policy covers

This Privacy Policy explains how CANARY TECH VENTURES S.R.L., a Romanian limited liability company, fiscal identification code (CUI) 50495119, with registered office in Romania ("GrooveCV", "we", "our", "us"), processes personal data in connection with the GrooveCV platform and related services (the "Service").

It applies to (i) individuals who use the Service on behalf of a customer organization (recruiters, admins, agency staff - "Authorized Users"); (ii) candidates whose data is uploaded to or processed through the Service by a customer organization (recruitment agency); (iii) end clients of customer organizations who receive shortlists through the Service; and (iv) visitors to our website and marketing channels.

This Privacy Policy is governed by Regulation (EU) 2016/679 ("GDPR"), Romanian Law No. 190/2018, the EU Artificial Intelligence Act (Regulation (EU) 2024/1689) where relevant, and the ePrivacy framework. It should be read together with our Terms and Conditions and our Data Processing Agreement (the "DPA").

Contact details: info@groovecv.com for general privacy inquiries; privacy@groovecv.com for data protection requests and rights exercise.

2. Our role under the GDPR

Our role depends on the type of personal data being processed and the context of the processing:

2.1 GrooveCV as data controller

We act as data controller for personal data we collect to operate and improve the Service, including: (i) Account and user profile data of Authorized Users; (ii) billing and payment data; (iii) telemetry, security logs, and analytics; (iv) marketing and support communications; (v) website visitor data; and (vi) email interaction data when Authorized Users send communications through the Service (e.g., open/click telemetry that benefits the Authorized User's organization).

2.2 GrooveCV as data processor

We act as data processor on behalf of customer organizations for personal data those organizations upload to or process through the Service in connection with their recruitment activities. This includes:

  • Candidate Data (CVs, resumes, profiles, professional history, notes, attachments).
  • Client Portal recipient data (names, emails, feedback, comments submitted by the customer's end clients through portal links).
  • Interview scheduling data (proposed and confirmed time slots, attendee details, optional recordings).

For this processing, the customer organization is the controller and GrooveCV is the processor. The terms of the DPA between GrooveCV and each customer organization govern this processing.

2.3 Joint or independent controllers

In limited cases (e.g., where we and a customer jointly decide the means of an integration), we may act as joint controllers. We will document and disclose any such arrangement in writing.

3. Categories of personal data we process

3.1 Account and user data (we are controller)

  • Identification data: name, business email address, business phone number, photo (optional).
  • Account credentials: hashed password, multi-factor authentication tokens, API keys.
  • Organization data: company name, registration number (CUI), addresses, user roles (Admin, Recruiter), team structure, branding assets.
  • Communication preferences: language, notification settings, opt-ins for marketing.

3.2 Billing and payment data (we are controller)

  • Billing details: invoice address, VAT number, contact for billing.
  • Payment metadata: amount, currency, status, last four digits and brand of card (full card details are never stored on our servers; they are handled by Lemon Squeezy or Paddle as merchant of record).
  • Subscription history and transactional records.

3.3 Candidate Data (customer is controller, we are processor)

  • Identification: name, email, phone number, location, photo (where provided).
  • Professional information: CV/resume content, experience, skills, education, certifications, languages.
  • Documents and attachments uploaded to the candidate record.
  • Notes and tags added by recruiters.
  • Structured profile data extracted from CVs through automated parsing (see Section 5).

We process Candidate Data exclusively on the instructions of the customer organization that uploaded it, in accordance with the DPA.

3.4 Client Portal data (mixed - see Section 2)

  • Recipient identifiers: name, work email, role at the recipient organization.
  • Feedback: ratings, comments, inline annotations on candidate profiles, hiring decisions, interview scheduling preferences.
  • Portal access logs: portal views, PIN entries, link clicks.

3.5 Telemetry, security, and analytics (we are controller)

  • Device data: IP address, browser type, device type, language and locale.
  • Usage data: pages and features accessed, timestamps, action history.
  • Error data: stack traces, error context (we apply best-effort sanitization to remove personal data from error reports).
  • Email interaction data: delivery status, open events (tracking pixels), link click events for Service-generated communications.

3.6 AI interaction logs (we are controller, with carve-outs for processor data)

  • AI model used, region, timestamp, prompt template version.
  • References to the input data processed (not the content itself).
  • Token usage and latency metrics.

4. Sources of personal data

We collect personal data from the following sources:

  • Directly from you when you create an Account, configure your organization, contact support, or interact with the Service.
  • Automatically through your use of the Service (telemetry, security logs, analytics).
  • From customer organizations that upload Candidate Data, share portals, and configure integrations on behalf of candidates and end clients.
  • From third-party service providers that support delivery of the Service (payment processors, email delivery, analytics) - see Section 9.

5. AI-assisted processing

5.1 Nature of AI processing

We use artificial intelligence as a writing assistance and informational tool to help recruiters draft professional content efficiently. Our AI features are designed by architecture not to evaluate, score, rank, or make decisions about candidates. All AI-generated outputs are drafts that must be reviewed, edited, and approved by a human recruiter before being shared with end clients or used in any capacity. No automated decision-making within the meaning of Article 22 GDPR takes place through our AI features.

5.2 What we use AI for

  • CV / resume parsing. Uploaded documents are processed by AI models to extract structured profile data (experience, skills, education).
  • Candidate summary drafting. AI generates draft summaries of candidate profiles contextualized to the position. Recruiters review and edit before sharing.
  • Skill matching. AI identifies which skills from a job description are present or absent in a candidate profile. This is a purely factual, informational comparison. No scores, percentages, rankings, or evaluative assessment is produced.
  • Comparative presentation drafting. AI structures candidate information side-by-side. Factual only - no evaluative judgments or indicators of superiority.

5.3 What our AI does NOT do

Our AI features do not produce scores, percentages, match rates, or rankings; do not identify "gaps" or "weaknesses"; do not recommend or shortlist candidates; do not make or influence hiring decisions; and do not use evaluative or comparative language.

5.4 Mandatory input anonymization

Before Candidate Data is sent to any AI provider, we apply a mandatory anonymization layer that removes personally identifiable information including name, age, gender, nationality, and photographs. Only professional information (experience, skills, education, certifications) in structured, anonymized form is sent to AI models. This prevents AI-based discrimination on protected characteristics.

5.5 EU data residency

All AI processing of Candidate Data occurs exclusively on EU/EEA-region endpoints of our AI providers. We use EU-region endpoints for Google Gemini, Mistral AI, and Anthropic (via AWS Bedrock or direct API EU regions where available). Where an EU region is unavailable for a particular model, we either do not use that model on Candidate Data or apply additional safeguards (including standard contractual clauses).

5.6 AI interaction logging

We log AI interactions (model, region, timestamp, prompt template version, references to data processed) for quality monitoring and auditability. Logs are retained for 12 months. The logs do not contain candidate identities since input is anonymized.

5.7 No model training on customer data

We do not allow any AI provider to use Candidate Data or other customer content to train, fine-tune, or improve their generally available models. This is contractually required of every AI subprocessor we use.

5.8 Transparency to candidates

Candidates whose professional profile data is processed by AI features are entitled to transparency about this processing. Customer organizations are responsible, as data controllers, for informing candidates that their professional data is processed with AI assistance. We provide template wording and documentation to support this.

6. Purposes and legal bases of processing

We process personal data for the following purposes, on the legal bases identified:

6.1 To provide and operate the Service (controller)

Authentication, account management, billing, customer support, feature operation. Legal basis: performance of a contract (Article 6(1)(b) GDPR) and, for processing related to customer organization staff, legitimate interest (Article 6(1)(f) GDPR) in operating the Service.

6.2 To process Candidate Data on behalf of customers (processor)

Storage, parsing, summarization, matching, portal delivery, feedback collection. Legal basis is determined by the customer organization as controller. We act on documented instructions per the DPA.

6.3 To secure the Service and prevent abuse (controller)

Logging, anomaly detection, rate limiting, fraud prevention. Legal basis: legitimate interest (Article 6(1)(f) GDPR) in protecting our infrastructure, our customers, and our users. We have conducted a legitimate-interests balancing test.

6.4 To improve the Service (controller)

Aggregated analytics, error monitoring, AI quality assurance using only de-identified or anonymized data. Legal basis: legitimate interest (Article 6(1)(f) GDPR).

6.5 To comply with legal obligations (controller)

Tax and accounting record-keeping, response to lawful requests, fulfillment of GDPR/AI Act obligations. Legal basis: legal obligation (Article 6(1)(c) GDPR).

6.6 Direct marketing (controller)

Product updates and feature announcements to existing customers based on legitimate interest in informing our customers (Article 6(1)(f) GDPR, with an easy unsubscribe option in every message). Promotional communications to prospects only on the basis of consent (Article 6(1)(a) GDPR) where required by Romanian and ePrivacy rules.

7. Cookies and similar technologies

We use cookies and similar technologies on our website and within the Service. Detailed information is available in our separate Cookie Policy. In summary:

7.1 Strictly necessary

Required for authentication, session management, security, and core functionality. No consent required under Article 5(3) ePrivacy Directive.

7.2 Functional / preference

Remember user preferences (language, layout). Used with consent where required.

7.3 Analytics

PostHog (EU region), Google Analytics, and Microsoft Clarity for product and website analytics. Used with consent for non-essential analytics where required.

7.4 Marketing

Used only with prior consent. May include advertising-network pixels on our marketing pages.

You can manage cookies through our consent banner and your browser settings. Disabling certain cookies may affect functionality.

8. Email tracking

Where you use the Service to send messages (for example, shortlist delivery emails to your end clients), the Service inserts tracking technology (tracking pixels and wrapped links) that report delivery, open events, and link clicks back to your Account. By using this feature you confirm you have the right to send tracked messages to the recipients in question.

9. Service providers and subprocessors

We engage a limited number of trusted service providers to support the Service. We require each subprocessor to provide GDPR-grade security and data protection guarantees and to commit to the data residency we promise. An up-to-date list is maintained on request and as Annex 2 to the DPA. As of the effective date of this policy, our key subprocessors are:

  • Amazon Web Services (AWS) - hosting, storage (S3), and infrastructure services in EU regions (Frankfurt, Ireland).
  • Supabase - managed database and backend services with EU data residency.
  • Resend - transactional email delivery.
  • Lemon Squeezy and Paddle - merchant of record and payment processing.
  • PostHog - product analytics (EU instance).
  • Sentry - application error monitoring.
  • Google Analytics and Microsoft Clarity - website analytics on our marketing site.
  • Google (Gemini, Vertex AI) - AI inference, EU regions.
  • Mistral AI - AI inference, EU region (France).
  • Anthropic (via direct EU endpoint or AWS Bedrock EU regions) - AI inference.
  • Video conferencing providers - for optional interview recording.

Where a provider is established outside the EU/EEA, we rely on European Commission adequacy decisions or, in their absence, on the European Commission's Standard Contractual Clauses together with supplementary technical and organizational measures (encryption in transit and at rest, access controls, audit logging).

10. International transfers

Candidate Data and Authorized User data are stored on EU/EEA infrastructure by default. Where any transfer outside the EU/EEA is necessary (e.g., a particular AI model that does not offer an EU region for that workload), we rely on Article 46 GDPR safeguards, primarily Standard Contractual Clauses, together with supplementary measures. We perform transfer impact assessments where required.

11. Retention

We retain personal data only as long as necessary for the purposes for which it was collected and to comply with legal obligations:

  • Account data: for the duration of your subscription, plus 30 days following termination, after which we delete or anonymize the data unless legal obligations require longer retention.
  • Billing and tax data: 10 years from the end of the fiscal year, as required by Romanian accounting law.
  • Candidate Data: processed and retained on instructions of the customer organization. By default, deletion within 30 days following the end of the customer's subscription.
  • Telemetry and security logs: 12 months.
  • AI interaction logs: 12 months for quality assurance and auditability (no candidate identities).
  • Video interview recordings: 7 days by default, configurable up to a limit set in the Service settings.
  • Marketing data: until you withdraw consent or for 24 months of inactivity, whichever is sooner.

12. Your rights

Under the GDPR you have the following rights in relation to personal data we control:

  • Right of access (Article 15) - obtain confirmation of whether we process personal data about you and a copy of that data.
  • Right to rectification (Article 16) - correct inaccurate or complete incomplete data.
  • Right to erasure (Article 17) - request deletion in defined circumstances. AI interaction logs may be anonymized rather than deleted for quality-assurance purposes.
  • Right to restriction (Article 18).
  • Right to data portability (Article 20) - receive certain data in a structured, machine-readable format.
  • Right to object (Article 21) - object to processing based on legitimate interest, including for direct marketing.
  • Right to withdraw consent (Article 7) - at any time, without affecting prior lawful processing.
  • Right not to be subject to automated decision-making (Article 22). Our AI features do not produce automated decisions with legal or similarly significant effects.
  • Right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, https://www.dataprotection.ro (https://www.dataprotection.ro)) or with the supervisory authority in your country of residence.

To exercise any right, contact privacy@groovecv.com. We will respond within 30 days, extendable by 60 days for complex requests, in accordance with Article 12 GDPR.

Candidate rights. Where a candidate's data is processed by a customer organization through the Service, the customer organization is the controller. Candidates should address their requests to the customer organization in the first instance; we will support the customer in fulfilling such requests in accordance with the DPA.

13. Security

We implement appropriate technical and organizational measures to protect personal data, including:

  • Encryption in transit (TLS 1.2+) and at rest (AES-256 or equivalent).
  • Multi-tenant architecture with row-level security and strict data isolation between organizations.
  • Role-based access control with the principle of least privilege.
  • Multi-factor authentication for production system access.
  • Continuous logging and monitoring, with alerting on anomalous activity.
  • Regular security testing and code review.
  • Vendor risk reviews for all subprocessors.
  • Documented incident response procedure with 24-hour internal escalation target and 72-hour external notification target.

No system is entirely secure. If you believe you have discovered a security vulnerability, please contact us at info@groovecv.com immediately.

14. Data breach notification

In the event of a personal data breach as defined in Article 4(12) GDPR, we will notify (i) the competent supervisory authority within 72 hours of becoming aware of the breach, where required by Article 33 GDPR, and (ii) affected data subjects without undue delay where required by Article 34 GDPR. Where GrooveCV acts as data processor, we will notify the customer organization without undue delay, in line with the DPA.

15. EU AI Act compliance

GrooveCV is committed to responsible AI use in compliance with Regulation (EU) 2024/1689 (the "AI Act"). Our AI features are designed by architecture as writing assistance and informational tools that help recruiters draft professional content and identify factual skill matches. They are not designed or intended to evaluate, score, rank, or make decisions about candidates.

By-design safeguards we maintain:

  • No scoring or ranking output.
  • No automated decision-making; mandatory human review gate.
  • No evaluative or comparative language in AI prompts or outputs.
  • Mandatory PII stripping for all data sent to AI providers.
  • EU/EEA data residency for AI processing.
  • Visible disclaimers on all AI-generated outputs.
  • Comprehensive audit trail of AI interactions, retained for 12 months.

We classify these features as AI systems with transparency obligations under the AI Act rather than as high-risk AI systems within the meaning of Annex III, Section 4(a). We continue to monitor official guidance from the European Commission and the AI Office and will update this position if necessary.

16. Children's data

The Service is intended for business use by recruitment professionals. We do not knowingly process the personal data of children. If you believe a child's personal data has been provided to us, contact privacy@groovecv.com and we will delete it without delay.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email to active customer organizations at least 30 days before they take effect. The most current version is always available on our website. The "Effective date" at the top of this document indicates the latest revision.

18. Contact

GrooveCV (the controller identified in Section 1)

Romania

Email (general): info@groovecv.com

Email (data protection): privacy@groovecv.com

Supervisory authority: ANSPDCP, https://www.dataprotection.ro (https://www.dataprotection.ro), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, 010336, Romania.