Privacy Policy

1.1 Account Information

When you create an account, we collect:

• Full name, email address, and password (or OAuth credentials)
• Organization name, industry, size range, and website
• Role/title, phone number, and timezone
• Avatar or profile photo (if provided)

1.2 Candidate Data

As a recruiting platform, VScout processes candidate data that you or your organization uploads. This may include:

• Names, email addresses, phone numbers, and physical addresses
• Resumes, cover letters, and portfolio URLs (LinkedIn, GitHub, etc.)
• Interview notes, scorecards, and evaluation feedback
• Employment history, skills, and education
• GDPR consent records (timestamp, IP address, consent scope)

Important: You are the data controller for candidate data you upload to VScout. We act as a data processor on your behalf. You are responsible for obtaining appropriate consent from candidates before uploading their data.

1.3 Usage Data

We automatically collect:

• Pages visited, features used, and session duration
• Chat messages and AI agent interactions
• Job descriptions and pipeline configurations
• Browser type, operating system, device type, and IP address
• Referring URLs and search terms that led you to VScout

1.4 Payment Information

Subscription payments are processed by our payment provider, Polar. We do not store credit card numbers or full payment details on our servers. We receive a customer ID, subscription status, and billing plan information from Polar.

1.5 Connected Google Workspace Data

When you connect a Google account to VScout (Sign in with Google, Google Calendar, or Gmail), we receive and store the following:

• Sign in with Google: Your Google account email, name, profile picture URL, and Google account identifier (the OpenID sub claim)
• OAuth tokens: Encrypted access and refresh tokens, granted scopes, and token expiry timestamps - stored in our integrations table so VScout can act on your behalf for features you authorized
• Google Calendar: Calendar event metadata for events VScout creates or reads on your behalf (interview events, free/busy windows of the organizer and invited interviewers, RSVP statuses, Google Meet conference links we generate)
• Gmail: Metadata about outbound messages VScout sent through your account (recipient, subject, send timestamp, optional thread/reply identifiers). We do not read your inbox, drafts, or messages you did not send through VScout

You can disconnect any Google integration at any time from Settings → Integrations. Disconnecting revokes our tokens, after which we can no longer call Google APIs on your behalf. You can also revoke access directly from your Google Account permissions page.

We use collected information for the following purposes:

• Service delivery: Providing, maintaining, and improving the VScout platform, including agent-led candidate screening, job description generation, interview scheduling, and pipeline management
• AI processing: Powering our AI agent (Vesper) to analyze resumes, generate recommendations, screen candidates, and automate recruiting workflows
• Communications: Sending transactional emails (account verification, interview confirmations, offer letters, status updates) via Resend
• Analytics: Understanding usage patterns to improve product features and user experience
• Support: Responding to your inquiries and providing customer support
• Security: Detecting, preventing, and addressing fraud, abuse, and security issues
• Legal compliance: Fulfilling legal obligations and enforcing our Terms of Service

VScout uses artificial intelligence to enhance recruiting workflows. Transparency about our AI practices is important to us:

• AI models used: We use Anthropic's Claude API (Sonnet for primary tasks, Haiku for classification) to power our AI agent
• What AI processes: Resumes, job descriptions, candidate profiles, and chat interactions are sent to Anthropic's API for processing. We also generate vector embeddings of candidate profiles for semantic search and matching
• No model training: Your data is never used to train Anthropic's or any third-party AI models. All API calls use zero-retention endpoints
• Full audit trail: Every AI action is logged with its reasoning, input, output, and the user who triggered it - available for your review at any time
• Human oversight: AI provides recommendations and suggestions. Final decisions (hiring, rejection, offers) always require human approval
• Bias monitoring: We implement fairness checks in screening algorithms and monitor for discriminatory patterns
• Opt-out: You can disable AI features for specific workflows in your organization settings

We do not sell your personal data. We share information only with the following categories of recipients:

4.1 Sub-Processors

A current list of sub-processors is maintained at /security and updated when we add or change a vendor.

4.2 Other Sharing

• With your consent: When you explicitly authorize sharing, such as publishing public career pages or enabling integrations
• Legal requirements: When required by law, subpoena, court order, or governmental request
• Safety: To protect rights, property, or safety of VScout, our users, or the public
• Business transfers: In connection with a merger, acquisition, or sale of assets - you will be notified before data is transferred to a new entity

4.3 Google API Services User Data Policy

VScout's use and transfer of information received from Google APIs (including Sign in with Google, Google Calendar, Gmail, Google Meet, and Google Chat) to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Scopes we request and how we use them

Our Limited Use commitments

VScout's use of data obtained through the scopes above is restricted as follows:

• We only request the scopes needed to deliver features you have explicitly authorized. We use incremental authorization, so connecting Calendar does not also grant Gmail access (and vice versa)
• We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features that are prominent in the VScout user interface, to comply with applicable law, or as part of a merger, acquisition, or sale of assets (with notice)
• We do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising
• We do not use Google user data to develop, improve, or train generalized or non-personalized AI/ML models. Google user data is never sent to Anthropic, OpenAI, or any other model provider for training purposes. The only AI processing that touches Google data is per-request, on-behalf-of-user generation (e.g., drafting an interview-summary message before you send it via Gmail), and Anthropic's zero-retention endpoints are used for those calls
• We do not allow humans to read Google user data unless (a) we have obtained your affirmative agreement to view specific messages, (b) the data is required for security purposes such as investigating abuse, (c) the data is needed to comply with applicable law, or (d) the data is aggregated and used for internal operations in accordance with applicable privacy laws
• OAuth tokens are stored encrypted at rest, scoped to your organization via Row-Level Security, and can be revoked at any time from your VScout integrations page or your Google Account permissions page

VScout is based in the United States. If you access our Service from outside the US (including the European Economic Area, UK, or other regions with data protection laws), your information will be transferred to and processed in the US.

For transfers of personal data from the EEA/UK to the US, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission, incorporated into our Data Processing Agreement
• Sub-processor compliance with the EU-US Data Privacy Framework where applicable
• Supplementary technical measures including encryption in transit and at rest

Enterprise customers may request EU data residency. Contact admin@vscout.co for details.

We retain data only as long as necessary for its purpose:

When candidate data reaches its retention limit, we automatically anonymize it: personal identifiers are replaced with placeholder values, and do_not_contact is set. Anonymized records are retained for aggregate reporting but can no longer be linked to individuals.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a structured, machine-readable format (CSV or Excel)
• Restriction: Request that we limit processing of your data
• Objection: Object to processing based on legitimate interests or for direct marketing
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing
• Automated decisions: Right not to be subject to decisions based solely on automated processing that produce legal effects

How to exercise your rights: Logged-in users can export or delete their data from Settings → Privacy & Data. You can also email admin@vscout.co. We will respond within 30 days (or 72 hours for deletion requests under GDPR).

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know: What personal information we collect, its sources, purposes, and who we share it with (detailed in Sections 1-4 above)
• Right to delete: Request deletion of your personal information
• Right to opt-out of sale: We do not sell personal information. We do not share personal information for cross-context behavioral advertising
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights
• Right to correct: Request correction of inaccurate personal information
• Right to limit use of sensitive data: We only use sensitive personal information as necessary to provide the Service

Categories of personal information collected (per CCPA definitions): Identifiers, professional/employment information, internet activity, geolocation (approximate, from IP), and inferences drawn from the above.

To exercise your CCPA rights, email admin@vscout.co with the subject line "CCPA Request." We will verify your identity before processing.

9. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA) or United Kingdom, the General Data Protection Regulation (GDPR) applies. Here is how we comply:

Lawful Bases for Processing

• Contract performance: Processing necessary to provide the Service you signed up for (account management, platform features)
• Legitimate interests: Analytics, fraud prevention, product improvement - balanced against your rights
• Consent: Marketing emails, non-essential cookies, and optional AI features - withdrawable at any time
• Legal obligation: Tax and accounting records, regulatory compliance

Data Protection Officer

For GDPR-related inquiries, contact our Data Protection team at admin@vscout.co.

Supervisory Authority

You have the right to lodge a complaint with your local data protection authority if you believe your data is being processed unlawfully.

For more details on your GDPR rights and how to exercise them, visit our GDPR Rights page.

We use cookies and similar technologies for authentication, analytics, and to remember your preferences. A summary:

• Essential cookies: Authentication session, CSRF protection, cookie consent preference - required for the platform to function
• Analytics cookies: PostHog and Google Analytics 4 for product and site analytics - can be opted out
• Marketing cookies: Google Tag Manager loads the Google Ads conversion pixel to attribute signups and paid conversions to ad clicks - can be opted out. We also capture the gclid click identifier from landing URLs so we can send server-side offline conversions back to Google Ads even if the marketing cookie is rejected. No personal data is included in these conversion uploads beyond the hashed click ID

You can manage your cookie preferences at any time using our cookie banner or by visiting our Cookie Policy for full details.

11. Children's Privacy

VScout is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at admin@vscout.co.

12. Security Measures

We implement comprehensive security measures to protect your data:

• AES-256 encryption at rest; TLS 1.3 in transit
• Row-Level Security (RLS) policies isolating data between organizations
• Role-based access control (Admin, Recruiter, Hiring Manager, Viewer)
• Rate limiting on all API and authentication endpoints
• Regular security audits and penetration testing
• Automated backups encrypted with separate keys

No system is 100% secure. While we take extensive precautions, we cannot guarantee absolute security. For details, see our Security page.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to your registered address and/or by a prominent notice on the Service at least 30 days before taking effect. Your continued use of VScout after changes become effective constitutes acceptance.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices:

• Email: admin@vscout.co
• Legal entity: VScout
• Response time: Within 30 days of receipt