Privacy notice
ColdAI LLC · Updated 14 September 2026 · Version 2026-09-14.1
1. Controller and contact
ColdAI LLC, a Delaware limited liability company (Delaware file no. 7646800), with head office at 651 N Broad St, Suite 201, Middletown, Delaware 19709, New Castle County, United States, is responsible for Recrewd’s processing described here. Contact shayan@coldai.org with the subject “Recrewd privacy” for questions, access, correction, deletion, objection or an appeal. This notice covers candidates, business contacts and visitors. Employers receiving an authorised introduction generally act as independent controllers for their hiring activities.
2. Information you provide
We process account email and password hash; your name, desired roles, career history, current and preferred locations, work arrangement and salary preferences; uploaded CVs and their role notes; optional profile photos; chat messages, job descriptions, AI-generated drafts, voice transcripts and confirmed profile changes. Business enquiries include company, contact details, hiring needs and package preferences. We also process support correspondence and your sharing, consent and membership choices. Do not include unnecessary health, identity-document or other sensitive information in CVs or chat.
3. Technical and transaction information
We use session identifiers, timestamps, verification status, security and rate-limit records and AI usage counters to operate and protect the service. Hosting and delivery providers may process IP addresses, browser/device information and request logs. Passwords are stored as hashes, not readable passwords, and are not sent to Rec. When you use checkout, the payment provider processes payment details and we receive subscription, transaction and billing identifiers.
4. Sources
Most information comes directly from you and your use of Recrewd. AI produces draft text and inferred career suggestions from those inputs. Employers may provide interview or application status and we may use employer-provided vacancies. If we obtain prospect information from public professional profiles or third parties, we provide the applicable source and purpose information and respect required notice and objection rights. This notice does not authorise unrestricted scraping.
5. Purposes and legal bases
Where a law requires a legal basis, we rely on contract necessity for account access, requested CV and AI tools and agreed service delivery; legitimate interests for proportionate security, fraud prevention, service diagnostics and responding to business enquiries, balanced against your rights; and legal obligations for required compliance and records. Optional sharing, marketing or sensitive-data uses rely on consent where required, requested separately. We do not make consent to unrelated advertising a condition of membership. Withdrawal does not affect earlier lawful processing, but we stop future consent-based processing unless another lawful basis applies.
6. AI, profiling and voice
Rec sends relevant profile information, recent conversation, your supplied job description and selected CV text to OpenAI to generate career assistance. In the current chat flow, the selected CV is extracted for that conversation. Separate optional demographic answers are excluded from Rec’s context. Text generation requests disable response storage, but provider security, abuse-monitoring and retention policies may still apply; this is not a promise of zero provider retention. Rec conversations and drafts are saved in your account. Voice is optional: microphone audio is transmitted to OpenAI during the connected session, Recrewd does not save audio recordings, and text transcripts are saved in the conversation. Rec’s voice is synthetic. You can end voice or delete a conversation. AI suggestions can be wrong and may infer skills or fit from your material; request correction or contact us to challenge a suggestion. Employers make employment decisions, and proposed profile edits require your confirmation.
7. Optional sensitive information
Separate disability, ethnicity and sexual-orientation answers are optional; their collection is currently disabled. Skipping does not affect selection. Before enabling collection we must explain the specific purpose, legal basis, retention and recipients and obtain explicit consent where required. The existing separate-answer mechanism encrypts answers and excludes them from matching, ranking, Rec context and automatic employer sharing. Sensitive details you voluntarily put inside an ordinary CV or chat are not automatically separated or removed and may be processed with that content. Avoid including them unless necessary. You can withdraw separately stored optional answers through your profile or contact us.
8. Who receives information
Cloudflare provides hosting, database and file storage. OpenAI processes AI inputs and outputs. Resend provides email delivery and Stripe provides payment processing. Providers receive the information needed for their services and may have independent legal and security responsibilities. Your separate introduction authorisation permits sharing relevant career information and CVs with hiring recipients within your preferences; your password, private chats and separately stored demographic answers are not part of an introduction. We may disclose necessary information to professional advisers, authorities when legally required, or a successor in a genuine business transaction with applicable safeguards and notice.
9. Sale, advertising and communications
We do not sell your personal information or disclose it for cross-context behavioural advertising. An authorised employer introduction is for your requested recruitment service, not a public CV directory. The current application has no advertising or marketing-analytics cookies. Essential service and security communications are separate from optional promotional email. Any marketing programme must provide an opt-out and obtain consent where required. You can object to direct marketing by contacting us.
10. Cookies and local storage
The recrewd_session cookie is an essential sign-in cookie, normally lasting up to seven days. It is HttpOnly and SameSite=Lax, and uses Secure on HTTPS. Blocking it prevents authenticated features. Hosting or payment services may use their own necessary security cookies when you interact with them. Non-essential tracking must not be enabled without the notice and choice required by applicable law.
11. Retention and deletion
We keep account, profile, CV and conversation information while needed to provide your account and requested services, subject to your deletion instructions. You can delete CVs and chats or request account deletion in settings. Account deletion removes active account records and conversations, makes uploaded files inaccessible and queues those files for permanent removal; it is not an instant-erasure guarantee for all infrastructure. The file-cleanup schedule still requires operational activation. Verification and password-reset tokens expire after 24 hours and 30 minutes respectively; expired records are removed through maintenance. Limited information may be retained where necessary for a specific legal obligation, security incident or legal claim, with access restricted and retention limited to that purpose. Provider logs, backups and legally required payment records can have separate retention periods. Contact us for the status and scope of a deletion request.
12. International processing
We operate from the United States and our providers may process data in the US and other countries. These countries may provide different protections from your home country. Where restricted-transfer rules apply, appropriate contractual or other lawful safeguards must be in place before the transfer; simply accepting these terms or this notice is not a substitute. We do not claim that ColdAI is certified under a data privacy framework or that a UK/EU representative or transfer agreement is already appointed or executed. Contact us to request applicable transfer information. International-transfer arrangements and representative requirements remain part of launch preparation.
13. Your privacy rights
Depending on applicable law and your circumstances, you may request access or a copy, correction, deletion, portability, restriction, objection to legitimate-interest processing, withdrawal of consent, or review of qualifying automated decisions. Where applicable you may opt out of sale, targeted advertising and legally significant profiling; we do not currently sell data or use it for targeted advertising. We may proportionately verify identity, accept authorised agents where required and explain any lawful exception. We respond within the applicable statutory time limit and explain any permitted extension. You may appeal a refusal by emailing us with “Privacy appeal”; we review it and explain the result within the applicable period. You may complain to the regulator where you live, including the ICO in the UK, the relevant EEA supervisory authority or the Delaware Department of Justice where applicable. You do not have to complain to us first and we do not retaliate for exercising rights.
14. Security and children
We use access controls, password hashing, authenticated document access and other safeguards, but no internet system is perfectly secure. Notify us promptly of suspected unauthorised access. We assess incidents and notify affected people and authorities when required by law. Recrewd is intended for adults aged 18 or over; if you believe a child has provided information, contact us so we can investigate and remove it as appropriate.
15. Changes and service status
We date and version this notice and provide appropriate notice of material changes. A new purpose requiring consent will not be authorised merely by posting revised text. This notice describes how Recrewd handles data across account, AI, introduction, employer and payment workflows; each specific transaction or disclosure still depends on the controls and permissions described above.
Contact: shayan@coldai.org