GDPR & Your Rights

Last updated: April 14, 2026

VScout is committed to full GDPR compliance. This page explains your rights under the EU General Data Protection Regulation and how to exercise them.

Our GDPR Commitment

The General Data Protection Regulation (GDPR) applies to VScout when we process personal data of individuals in the European Economic Area (EEA) and United Kingdom. We take our obligations seriously:

  • Privacy by design: Data protection is built into our architecture from the ground up — row-level security, encryption, and data minimization
  • Lawful processing: We process personal data only with a valid legal basis (contract, consent, legitimate interest, or legal obligation)
  • Transparency: Our Privacy Policy clearly explains what data we collect, why, and who we share it with
  • Data minimization: We collect only the data necessary to provide our Service
  • Breach notification: In the event of a data breach, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay

Your Data Rights

Right of Access

You can request a complete copy of all personal data we hold about you. We will provide this in a structured, machine-readable format within 30 days.

How: Go to Settings → Privacy & Data → Export Data, or email privacy@vscout.ai

Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected.

How: Update your profile in Settings, or email privacy@vscout.ai with the corrections needed

Right to Erasure

You can request that we delete all your personal data ("right to be forgotten"). This includes your account, candidate data you uploaded, and AI action logs.

How: Go to Settings → Privacy & Data → Delete Data, or email privacy@vscout.ai

Right to Data Portability

You can export all your data in standard formats (CSV, Excel). This includes candidates, jobs, pipeline history, and interview records.

How: Go to Settings → Privacy & Data → Export Data

Right to Restrict Processing

You can request that we temporarily stop processing your personal data while a dispute is resolved or accuracy is verified.

How: Email privacy@vscout.ai with your restriction request

Right to Object

You can object to processing based on legitimate interests (e.g., analytics) or for direct marketing purposes. We will stop processing unless we have compelling legitimate grounds.

How: Email privacy@vscout.ai or unsubscribe from marketing emails directly

Controller & Processor Roles

ScenarioData ControllerData Processor
Your account data (name, email, etc.)VScout—
Candidate data you uploadYour organizationVScout
Candidates applying via career pageYour organizationVScout
Website analytics & cookiesVScoutPostHog, Google

When we act as a data processor on your behalf, we process candidate data only according to your instructions and our Data Processing Agreement.

International Data Transfers

VScout's infrastructure is primarily located in the United States. For transfers of personal data from the EEA/UK, we implement:

  • Standard Contractual Clauses (SCCs) as approved by the European Commission, incorporated into our Data Processing Agreement
  • Technical safeguards: AES-256 encryption at rest, TLS 1.3 in transit, and strict access controls
  • Sub-processor compliance: All our sub-processors maintain their own GDPR compliance and data transfer mechanisms
  • EU data residency: Available for Enterprise customers upon request

For Candidates

If you are a job candidate whose data has been uploaded to VScout by a prospective employer:

  • The company that uploaded your data is the data controller. Contact them first for access, rectification, or deletion requests
  • If you applied via a VScout career page, you provided consent at the time of application. You can withdraw consent by contacting the company or emailing privacy@vscout.ai
  • We support candidate data rights through our platform: employers can process erasure and portability requests directly
  • Candidate data is subject to retention policies set by the employer. After the retention period, data is automatically anonymized

Data Processing Agreement & Contact

Enterprise customers and organizations requiring formal GDPR compliance documentation can access our Data Processing Agreement (DPA), which includes Standard Contractual Clauses and our sub-processor list.

Data Protection Contact

  • Email: privacy@vscout.ai
  • Entity: Inevitable AI Group
  • Response time: Within 30 days (within 72 hours for erasure requests)

You also have the right to lodge a complaint with your local supervisory authority if you believe your personal data is being processed unlawfully.

Manage your data

Logged-in users can export or delete their data directly from their account settings.

Privacy & Data settingsContact privacy team
GDPR & Your Rights — VScout | VScout