Security & compliance
How we handle your data under the GDPR and the EU AI Act, and the rights you have.
App, database and files in the EU. AI and email providers outside the EU work under data processing agreements.
We collect only what is needed and use it only for hiring.
We treat our hiring AI as high-risk and meet those rules.
GDPR: General Data Protection Regulation
We are the controller for this website. Inside the product, the hiring company is the controller and we are its processor (Art. 28).
Lawful basis
Consent (Art. 6(1)(a)) for sign-ups and for sharing your profile with partner companies, plus contract performance. Separate consent (Art. 9(2)(a)) before every recording. Data is used only for hiring, and you can withdraw consent any time.
What we collect
From this site: name, email, optional company or role, language. In the product: resume, interview answers and scores. No biometric profiling.
Retention
Marketing leads: until you unsubscribe or after 24 months of inactivity. Candidate data: deleted on the employer's instruction.
Processors
Render and Vercel (Frankfurt), Cloudflare R2 (EU), Resend (email), and OpenAI and Anthropic. All under DPAs.
Security
TLS 1.3 in transit, AES-256 at rest, least-privilege access, data scoped per company account, append-only audit logs. Penetration testing is planned.
DPIA
We keep a Data Protection Impact Assessment (Art. 35) and share it with employers who need it.
EU AI Act: high-risk hiring AI
The EU AI Act (Regulation 2024/1689) classifies hiring AI as high-risk (Annex III, point 4). Here is what we do:
Risk-management system (Art. 9)
A risk register covering bias, hallucination, data poisoning and model drift, reviewed before every release.
Data governance (Art. 10)
Documented evaluation data, checked for bias across age, gender, nationality and disability where lawful.
Technical documentation (Art. 11)
Annex IV documentation of architecture, data, metrics and limits. Available under NDA.
Logging (Art. 12)
Tamper-evident logs of every model call, its output and any human override.
Transparency to deployers (Art. 13)
A usage manual covering purpose, accuracy, known biases and oversight.
Human oversight (Art. 14)
Evidence next to every score. Auto-rejection is disabled. Recruiters can override and explain.
Accuracy robustness and cybersecurity (Art. 15)
Accuracy thresholds, model versioning, prompt-attack monitoring and vulnerability disclosure.
Deployer obligations (Art. 26)
Help with your own duties: oversight, candidate notices and monitoring.
Fundamental-rights impact assessment (Art. 27)
A starter template for the fundamental-rights impact assessment, based on EU guidance.
The controls you have
If you signed up here or were assessed through AI-serves, you have these rights. We reply within 30 days (GDPR Art. 12(3)).
- Access (Art. 15): get a copy of your data.
- Rectification (Art. 16): correct what is wrong.
- Erasure (Art. 17): have your data deleted.
- Restriction (Art. 18): pause processing during a dispute.
- Portability (Art. 20): export your data.
- Objection (Art. 21): object to processing.
- No solely automated decisions (Art. 22): guaranteed by the product.
- Explanation (AI Act Art. 86): of any AI-assisted decision about you.
Data Protection Officer: email info@ai-serves.world. You can also lodge a complaint with your local supervisory authority.
For information only, not legal advice. The Privacy Policy and our Data Processing Agreement govern.