Legal notice

Last updated: 4 October 2026

This translation is provided for information only; in the event of any discrepancy, the French version prevails.

Website publisher

RecrutIA is a service published by ELVIO TRADE, a French simplified joint-stock company (société par actions simplifiée, SAS).
Registered office: 28 B avenue de Toulouse, 31620 Castelnau-d'Estretefonds, France
SIREN (French company number): 107 414 229
SIRET (registered office): 107 414 229 00016
EU VAT number: FR66107414229
Contact: contact@recrutia-ai.com

Hosting

Render Services, Inc. — 525 Brannan St., San Francisco, CA, USA.
The data and the application are hosted in the Frankfurt region (Germany, European Union).

Privacy policy (GDPR)

Data processed

On behalf of its clients (recruitment agencies and companies recruiting for their own needs), RecrutIA processes: candidate data (CVs, names, contact details, career history, messages exchanged); data on the business contacts of clients and prospects (name, job title, contact details, exchanges, objection to business development); for electronic signatures, the documents to be signed (contracts, offers of employment, offer letters, which may state a salary) and the signers' data (name, email address, phone number where applicable, image of the drawn signature, truncated IP address and keyed fingerprint of the full address, browser, dates), kept for 1 to 10 years depending on the client's setting; for telephony, the call log (numbers, date, duration, outcome, notes), with no recording of conversations. RecrutIA acts as a processor (Article 28 GDPR); the client remains the controller. To operate the accounts, RecrutIA also processes data on their users: identity, email address, phone number given for connecting calls, devices subscribed to notifications.

Purposes

AI-assisted analysis and scoring of applications, drafting of outreach emails, interview summaries, the client's business development (with objections respected), simple electronic signature of documents and retention of its evidence, telephony (call connection and call log), phone notifications, usage statistics.

AI-assisted decisions (AI Act)

The scores produced by the platform are decision aids: the final recruitment decision remains human. Every AI processing operation is logged and can be consulted by the client. The client must inform candidates that AI is used in pre-screening.

Retention and security

CVs are automatically purged no later than 90 days after their analysis (30 days by default; the period can be set by the client). Data is encrypted in transit (TLS); integration secrets are encrypted at rest (AES-256-GCM). Hosting in the European Union.

The database is backed up every day: backups are kept for 7 days by the hosting provider, and an encrypted copy (AES-256-GCM) is kept for 30 days in separate storage in France. Erased data disappears from the backups once these periods have elapsed.

Sub-processors

RecrutIA uses the following sub-processors:

• Render Services, Inc. — hosting of the application, the database and the daily backups — European Union (Frankfurt, Germany)
• Anthropic — primary AI engine (CV analysis, candidate files, references, summaries) — United States
• OpenAI — fallback AI engine, used only for the Pro plan when the primary engine is unavailable — United States
• Stripe — subscription payments and invoicing — European Union and United States
• Resend — sending of the emails issued by the platform (notifications, personal links, reference requests, and messages to candidates and contacts when the client has not connected its own mailbox) — United States
• Scaleway — off-site storage of the encrypted backup copies, kept for 30 days — France (Paris region, European Union)
• OVH — domain name, DNS and routing of the contact email address — European Union

Where the use of a sub-processor involves a transfer of data outside the European Union (in particular to the United States), the transfer relies on the adequacy decision for the EU–US Data Privacy Framework (Article 45 GDPR) where the recipient is certified under it, or otherwise on the European Commission's standard contractual clauses (Article 46 GDPR).

Clients are notified of any addition or replacement of a sub-processor thirty days in advance, in accordance with the DPA.

Your rights

Under the GDPR, every data subject has the rights of access, rectification, erasure, restriction of processing and objection. Candidates may exercise these rights with the agency or company recruiting them, or with the publisher (contact details above).

The controller responds without undue delay and in any event within one month of receipt of the request; that period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case the person is informed within one month of receipt (Article 12(3) GDPR). Where a request concerning data processed on behalf of a client is sent to the publisher, the publisher forwards it to the client concerned and assists the client in responding.

You may lodge a complaint with the CNIL (cnil.fr), the French data protection authority, or with the supervisory authority of the Member State of your habitual residence or place of work (Article 77 GDPR).

Cookies

The site uses only strictly necessary technical cookies (login session, language preference). No advertising or third-party tracking cookies are used.