Privacy Policy

Overview

Colleagu provides an AI-powered recruitment platform for employers, recruiters, hiring teams, and candidates. We process personal information to operate the platform, analyze CVs, support candidate matching, schedule interviews, communicate with users, secure the services, and comply with legal obligations.

Candidate Data We Collect

• Name, email address, phone number, and contact details.
• CVs, resumes, cover letters, portfolios, and uploaded files.
• Work history, education, skills, certifications, languages, and professional qualifications.
• Job applications, screening answers, interview notes, evaluations, scores, recommendations, and hiring workflow status.
• Interview scheduling data, call recordings, transcripts, SMS, WhatsApp, and email communications where enabled.

Recruiter and Employer Data We Collect

• Account details, including name, email, phone number, role, login activity, and authentication data.
• Company details, billing details, subscription information, team members, permissions, and company profile data.
• Job postings, job descriptions, hiring requirements, interview notes, candidate evaluations, and recruiter communications.
• Support requests, onboarding details, settings, integrations, and platform configuration choices.

Data We Receive When You Sign In With Another Service

You can create an account or sign in using Google, Microsoft, or LinkedIn instead of a password. If you do, we ask that service only for the scopes needed to identify you — openid, profile, and email — and we receive only what those return:

• Your name, your email address, and the account identifier that service uses for you.
• Whether that service confirms it has verified your email address.

We use it for one purpose: to create your account, or to recognise you when you return. We store the account identifier so that signing in again reaches the same account even if you later change your email address at that service. We do not receive, request, or store your password, your contacts, your connections, or your message history, we never post or act on your behalf, and we do not use the data for advertising or sell it.

If the service does not confirm that it has verified your email address, we will not use that address to reach an account that already exists — we ask you to sign in the way you normally do instead, and where we create a new account we verify the address ourselves by email before the account can be used.

You can disconnect a service at any time from that service’s own settings, or by contacting us using the details below. Deleting your account deletes the connection with it, as described in Retention and Deletion, and you can ask us to delete this data at any time.

Technical Data We Collect

• IP address, browser type, device information, operating system, approximate location, and language settings.
• Cookies, session identifiers, authentication tokens, analytics events, log data, page views, clicks, and feature usage.
• Security telemetry, audit logs, API activity, error logs, and performance data.

Analytics and Tracking Tools

We use Google Analytics 4, Microsoft Clarity, and our own first-party analytics to understand product usage, improve performance, and prevent abuse. None of them load until you accept analytics cookies, and Microsoft Clarity is additionally restricted to an explicit list of public pages so that session replay can never capture candidate data. We do not run advertising pixels. The complete list, and the cookies each one sets, is in our Cookie Policy.

How We Use Information

• Provide, operate, maintain, and improve Colleagu.
• Analyze CVs, extract candidate details, match candidates to roles, rank or recommend candidates, and support recruitment workflows.
• Create and manage accounts, companies, jobs, applications, interviews, calls, messages, and subscriptions.
• Send service messages, verification emails, interview communications, support replies, and product notices.
• Detect, investigate, and prevent fraud, abuse, security incidents, policy violations, and illegal activity.
• Comply with legal obligations, enforce agreements, resolve disputes, and protect rights and safety.

AI Processing

Colleagu uses Artificial Intelligence for CV analysis, candidate screening, candidate matching, ranking, recommendations, summaries, interview workflows, and recruitment automation. AI outputs may be inaccurate or incomplete. Employers remain responsible for human review and final hiring decisions.

When We Are a Controller, and When We Are a Processor

Which role we play depends on the data, and it determines who you should go to about it:

• We are the controller for account data, billing data, support conversations, marketing and demo-request data, and the technical and analytics data described above. We decide why and how that data is processed. Direct requests about it to us.
• We are a processor for candidate and recruitment data that a customer puts into the platform — CVs, applications, screening answers, interview notes, call recordings, and transcripts. The employer or recruiter is the controller. They decide what is collected and why; we act on their instructions.

If you are a candidate and want your data accessed, corrected, or deleted, the fastest route is the employer or recruiter you applied to, because they control it. You can still contact us at privacy@colleagu.com and we will help, and where the law requires us to act directly we will.

Customers are responsible for having a lawful basis to collect and submit candidate data, and for providing the notices or obtaining the consents that the law applicable to them requires.

Sharing and Subprocessors

We do not sell personal information. We may share information with:

• Cloud, hosting, storage, database, monitoring, security, and infrastructure providers.
• AI and automation providers, including providers such as OpenAI, AWS, Alibaba Cloud, Google Cloud, and Microsoft Azure where used.
• Communications, email, SMS, WhatsApp, voice, calendar, authentication, analytics, and customer support providers.
• Stripe, for payment processing and subscription billing. Card details are handled by Stripe and never reach our servers.
• Employers, recruiters, team members, and candidates as needed to run the recruitment workflow.
• Legal authorities, regulators, courts, or third parties when required by law or needed to protect rights, safety, or security.

Retention and Deletion

• Account data is retained while the account is active and for a reasonable period after closure for legal, security, billing, fraud prevention, backup, and dispute purposes.
• Deleted account data is targeted for deletion or anonymization within 30 days unless a lawful retention reason applies.
• Candidate CVs and recruitment records may be retained for up to 24 months after last relevant customer activity unless deleted earlier or a customer agreement sets a different period.
• Backups may be retained for up to 90 days and removed through normal backup rotation.
• Security, audit, billing, and operational logs may be retained as needed for compliance, debugging, security, and business operations.

Security

We use technical and organizational safeguards designed to protect personal information, including encryption in transit, encryption at rest where supported, access controls, authentication controls, audit logs, monitoring, backups, and incident response procedures. No system is completely secure.

Security Incidents

If we determine that a security incident affects personal information, we will investigate, take reasonable steps to contain and remediate it, and notify affected customers or users as required by applicable law.

International Transfers

We may process and transfer information in the UAE and other countries where we or our subprocessors operate. Where required, we use appropriate contractual, technical, and organizational safeguards for international transfers.

Your Choices and Rights

• Access, update, correct, export, or delete account information where available.
• Request deletion or restriction of personal information, subject to legal and contractual limits.
• Object to certain processing or withdraw consent where processing is based on consent.
• Opt out of marketing communications at any time.
• Manage cookies through browser settings and any consent controls we provide.

UAE Personal Data Protection Law

Appilities is established in the United Arab Emirates, so Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL) applies to our processing.

• Lawful bases. We process personal data to perform a contract with you, to pursue legitimate interests such as securing the platform and preventing abuse, to comply with legal obligations, and on the basis of consent where consent is what the law requires — for example non-essential cookies and marketing email.
• Your rights. The PDPL gives you rights to access your data, to have it corrected, to have it erased, to restrict or object to processing, to receive it in a portable form, and to object to automated decision-making.
• Cross-border transfers. We and our providers process data outside the UAE. We rely on transfers to jurisdictions with an adequate level of protection, or on contractual safeguards where no adequacy decision applies.
• Complaints. You may complain to the UAE Data Office if you believe your rights have been infringed.

If You Are in California

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months. Because there is no sale or sharing, there is nothing for a "Do Not Sell or Share My Personal Information" request to opt out of — but you may still exercise your rights to know, delete, correct, and to be free from retaliation for doing so, by writing to privacy@colleagu.com.

Contact Us

For privacy questions, data requests, or deletion requests, contact privacy@colleagu.com.

The controller for the data we hold in our own right is Appilities, trading as Colleagu, Ajman NuVentures Centre Free Zone (ANCFZ), Ajman, United Arab Emirates.