Privacy.

1. Controller and contact

The controller responsible for Reclyra's own processing described in this policy is:

Further provider information can be found in the imprint.

2. Scope and data protection roles

This policy applies to reclyra.app, the redirect from reclyra.de, the associated company workspaces as well as customer and user accounts, insofar as Reclyra itself determines the purposes and means of the processing. It concerns in particular website visits, contact requests, registration, contract and billing processes, support and the secure operation of the platform.

For applications, the controller is, in principle, the company named in the job advertisement or on the application page. It determines the recruiting purpose, the legal basis, selection criteria, authorised persons, communication, retention and personnel decisions. Reclyra provides the technical platform for this and processes the application data on behalf of the company. The company's own privacy notices also apply.

Please direct requests concerning a specific application primarily to the company concerned. If such a request is received by Reclyra, we clarify responsibility and support its handling within the scope of our engagement.

3. Legal bases

The legal basis depends on the respective purpose and our role. For our own processing, the following apply in particular:

• Art. 6(1)(b) GDPR: steps prior to entering into a contract or the performance of a contract, where you yourself are a party to the contract.
• Art. 6(1)(c) GDPR: compliance with legal obligations, in particular for contract and billing records.
• Art. 6(1)(f) GDPR: legitimate interests in secure and functional operation, abuse prevention, business communication with contact persons of our customers, troubleshooting and the defence of legal claims.
• Art. 6(1)(a) GDPR: consent, insofar as a specific processing operation is based on it. Consent can be withdrawn with effect for the future.

For application data, the responsible company determines the legal basis. Art. 28 GDPR governs processing on behalf of a controller; it does not replace a legal basis for the application procedure.

4. Website access and technical data

When the website is accessed, the technical data required for transmission and operation is processed. This includes in particular the IP address, date and time, requested address, HTTP status, browser and device information, volume of data transferred and, where applicable, the referrer address transmitted by the browser and technical error data.

The processing serves delivery, stability, error analysis and the prevention of abusive access. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of the website and platform. Hosting and server-side application functions are provided via Vercel; forms and application content transmitted to the application are also processed in the process.

Technical log data is assessed according to its operational and security purpose. The decisive factors are the duration of an error analysis, the detection and investigation of specific misuse and the records required in the event of a security incident. A specific incident may justify longer retention of the data required for it.

5. Contact, sales and support

In the case of a contact or support request, we process the information transmitted, in particular names, business contact details, company, content and time of the message as well as the history required for handling it. In the case of technical questions, workspace information, error descriptions and screenshots provided by you may be added.

Submitting the contact form sends your selected topic, name, email address and message directly to Reclyra. We store the request in our internal inbox and assign it to the relevant contact area. You do not need a separate email program. The supplied reply address is checked for its format; this does not confirm who owns the mailbox.

The demo request form transmits your name, company, business email address, optionally your telephone number, company size, selected topics and your message to us. This information is also stored as a request in our internal sales inbox. To prevent misuse, we limit form requests using technical access counters and a hash of the email address.

We use IONOS for our business email mailboxes. Messages sent to our sales, support, general, privacy, billing and security addresses are additionally received through Resend and imported into the internal inbox. We store in particular the sender, subject, plain text, receipt time, technical message identifiers, verification status and number of attachments. When attachment import is enabled, PDF, DOC, DOCX, JPG and PNG files are additionally stored in private file storage at Supabase: at most five files per message, 10 MiB each and 25 MiB combined. An additional global storage cap limits imports. Before download, ClamAV in a Vercel Sandbox checks them for malware; access remains blocked until they pass this check. Attachments that were not imported and the complete original message may remain with IONOS and Resend. The personal mailbox oemer@reclyra.app is excluded from this automatic forwarding.

Authorised platform administrators handle these conversations, add internal notes and send reviewed replies through Resend to the assigned contact address. Reply text, sending status and conversation history are stored in the application. We use Vercel and Supabase for hosting and the database; further details on service providers and processing in third countries appear below.

On an explicit request by a platform administrator, an AI assistant can prepare a reply draft or a summary. Limited excerpts of the external message history and the working instruction are sent through Vercel AI Gateway to the configured model provider. The default uses Claude Haiku 4.5 from Anthropic. Internal notes and attachments are excluded; message text can nevertheless contain personal data and is not fully anonymised. The gateway request is configured to require zero data retention and to disallow prompt training for inference. This does not replace the application and email service storage cycles described below. A suggestion is not automatically stored or sent. The person handling the conversation adopts and reviews it and explicitly triggers sending or saving it as a note. The person handling the conversation remains responsible for review and sending.

Requests are handled on the basis of Art. 6(1)(b) GDPR if you yourself are entering into or performing a contract. For contact persons of a company and other requests, Art. 6(1)(f) GDPR applies; our interest is in handling the request, business communication and supporting our customers.

Retention depends on the completion of the request, open follow-up questions, the associated business relationship and any necessary contractual or legal records. Setting a conversation to “closed” does not delete data. There is no blanket automatic deletion of business correspondence after a fixed number of days; the operator handles necessary deletion in light of these purposes and obligations. Platform administrators can delete closed or spam conversations after reviewing a current preview and explicitly confirming deletion. This removes the conversation, messages and internal notes in Reclyra. Imported files are scheduled for deletion once any ongoing upload or security-check leases have expired. Minimal technical delivery identifiers that prevent re-import and a content-free deletion record remain. Copies at IONOS, Resend, recipients and in backups are not automatically covered and must be considered separately. Please do not send complete application documents, login credentials or special categories of personal data via general support channels unless this is necessary and has been agreed in advance.

6. Account, workspace and team management

For registration and use, we process names, email address, account identifier and authentication data. In addition, there is organisation membership, invitations, roles, job assignments, account status, settings, session data and functional actions triggered. The information comes from you or, for example in the case of an invitation and assignment of rights, from authorised persons of your company.

This processing enables sign-in, account management, role checks, workspace assignment and the provision of the service. The legal basis is Art. 6(1)(b) GDPR where you have your own contractual relationship and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in the performance of the contract with the customer company and in secure user operation.

The duration depends on the use and authorisation of the account and on whether associated contract, security or process records are still required. The end of a membership or pilot does not automatically result in the deletion of all account data. The validity of a sign-in session is limited in time and can be renewed with continued use; details are explained in the cookie and storage notice.

7. Contract, plan and billing

For quotes, contracts and billing, we process company and billing data, contact persons, plan, term, scope of services, customer and subscription identifiers, payment status and necessary invoice and transaction records. We use Stripe for payments and subscriptions. No application documents are transmitted to Stripe for payment purposes.

The legal bases are Art. 6(1)(b) GDPR where there is a direct contractual relationship, Art. 6(1)(c) GDPR for legal obligations and Art. 6(1)(f) GDPR for business communication, receivables management, fraud prevention and the defence of legal claims. Depending on the product and purpose, Stripe also processes data as an independent controller, for example to fulfil its own legal obligations.

Retention depends on the performance of the contract, the statutory retention obligations applicable to the respective record and the records needed for specific legal claims. These purposes must be distinguished from the retention of applicant data.

8. Platform messages and email delivery

Reclyra sends function-related messages, in particular for email verification and password recovery, as well as applicant and interview communication triggered by the customer. Resend is used for the technical delivery. In the process, sender and recipient, subject and message content as well as the sending identifier, timestamps and delivery information are processed.

If reply import is activated, replies to applicant messages can be received at Resend via a protected reply address. After checking the signature, sender and email authentication, the plain text, subject, time of receipt and number of attachments are assigned to the application. Attachments are not added to the applicant file. The content of such replies does not trigger any AI analysis or automatic personnel decision.

Our own account and service messages are based on Art. 6(1)(b) or (f) GDPR according to the respective contractual relationship. Applicant communication takes place on behalf of the responsible company. Internal mentions in applicant notes, by contrast, create notifications within Reclyra; they do not send an email.

For the retention of communication data, the delivery, the clarification of delivery errors, the process handled and necessary records are decisive. Messages in the workspace and at the delivery service provider have separate storage cycles. Messages already delivered cannot be removed from the recipients' mailboxes by a deletion in Reclyra.

For the Pro plan used, Resend states a retention period of 30 days for email and log data and seven days for backups. Early deletion of individual messages must be arranged separately with the service provider. This also applies to received content and attachments that Reclyra itself does not import. Details: Resend data protection information.

9. Security and logging

To prevent misuse, Reclyra processes technical access counters, timestamps and, depending on the request, IP-related or derived identifiers. Functional logs document, among other things, invitations, changes to jobs and selection criteria, application status, AI evaluations, human corrections, messages, exports, downloads and deletions. The action concerned, the user or system reference, the time and necessary assignments are recorded.

Insofar as Reclyra processes this data for its own secure operation, troubleshooting and the defence of legal claims, the legal basis is Art. 6(1)(f) GDPR. Functional logging in the application procedure forms part of the processing on behalf of the customer.

For recognised technical access counters, a limited clean-up after more than seven days is intended. A backlog is worked off in further runs; seven days is therefore not a guaranteed maximum storage period. For other records, the associated process, a specific security case and the necessity for clarifying legal claims are decisive. Further information can be found on our security page.

10. Application data and retention

On behalf of the customer, in particular contact details, job assignment, CV, professional information, information and documents submitted later by the applicant, internal notes, mentions and their read status, communication, interview information and processing history are processed. Applications also contain the reference to and version of the privacy notice displayed and the time at which it was acknowledged. This acknowledgement is not consent to a talent pool.

For a talent pool, the company can request separate, voluntary consent. Only the express consent of the data subject extends retention for this purpose by 180 days from consent. The personal decision link also allows consent to be withdrawn. After expiry or withdrawal, this additional retention ceases; the company's regular deletion rules and independently documented retention grounds remain decisive.

The company determines the retention required for its purpose. In Reclyra, no period is set by default. Authorised workspace managers can set 90, 180 or 365 days or a custom period of 1 to 3650 days. The period starts with the documented change to the status rejected and generates a deletion preview. It does not result in automatic deletion. An exception from this preview is not a general legal retention or processing block.

Deleting an individual application requires a current preview and express confirmation. Associated data and notes are removed; files are then deleted by a clean-up job that can be retried in the event of errors. Other applications by the same person are retained. Files already issued, messages sent, external calendar events and backup copies have separate life cycles. Deletion in the product does not promise immediate removal from all external copies.

11. AI-assisted analysis

The AI feature supports the structuring of CVs and their comparison with the company's job-related criteria. It can output professional information, criteria results, evidence, source references and uncertainties. The results may be incomplete or wrong and require human review.

For this feature, the model Claude Haiku 4.5 from Anthropic is configured via Vercel AI Gateway. In an activated analysis, the text extracted from the document is transmitted together with the selection criteria via the gateway to the provider selected by the gateway for model execution. The application removes certain recognised contact details and personal details passed to it. This is not complete anonymisation; the remaining text may still contain personal information.

Results as well as model, prompt and criteria versions are stored for traceability. Reclyra uses structured outputs and evidence and does not store any internal model reasoning. The processing takes place on behalf of the customer; the legal basis and the information of applicants lie with the responsible company. Further details can be found in the AI transparency notice.

Reclyra does not make any automatic hiring or rejection decision. The final decision remains with the company. We also do not make any decisions based solely on automated processing with legal or similarly significant effects within the meaning of Art. 22 GDPR in relation to website visitors and our own SaaS users.

12. Optional calendar connections

Where the feature is available, authorised users can actively establish a Google or Microsoft connection for calendars and interview appointments. Without this connection, Reclyra does not use this integration for the user concerned.

With an active connection, the account identifiers, email addresses, calendar and appointment data, participants, times, time zones, meeting links as well as access permissions and synchronisation information required for the feature are processed. The connection can be disconnected in the settings provided and access can be revoked with the respective provider. Appointments already created must be considered separately.

With Google, we store the account identifier, the name and the verified email address in order to display the connected account and assign it to the correct workspace membership. Access and refresh tokens are stored encrypted on the server. The calendar permission granted covers events in calendars that you own. Reclyra uses it to create, specifically retrieve, reschedule and cancel the interviews booked in Reclyra in your primary calendar and to request a Google Meet link for video interviews.

To avoid scheduling conflicts, Reclyra also reads limited busy information for the period being checked from the connected primary Google or default Microsoft calendar. This includes technical event identifiers, start and end times with time zone, cancellation and busy status, and the connected user's own response status. Titles, descriptions, locations and other participants' names or email addresses are not requested for this check. These other events are not stored in Reclyra or displayed as a calendar copy; their busy information is processed in memory only for the current scheduling check.

For this purpose, we transmit to Google the interview title, start, end, time zone, where applicable the location as well as the name and email address of the person invited. Google may send event invitations and updates for this. Event and meeting links as well as the synchronisation status are stored in the associated interview and displayed to authorised workspace members and the intended interview participants or communicated in appointment notifications via Resend. Hosting and storage take place via the Vercel and Supabase services described below.

Google user data is used exclusively for these calendar functions and their secure operation. It is not sold, used for advertising or for training AI models and is not passed on to the CV analysis. The use and transfer of this data are subject to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect the connection under Interviews in the “Your calendars” area. Open interviews must first be cancelled and their calendar changes completed. When disconnecting, Reclyra deletes the stored access and refresh tokens; the account assignment and interview data already stored are retained in accordance with their respective retention purpose. You can additionally revoke the Google permission in the connections of your Google Account. This revocation does not remove calendar entries already created. For deletion requests, you can reach us via the data protection contact named above.

Our own account and integration management takes place on the basis of Art. 6(1)(b) or (f) GDPR according to the contractual relationship. Interview and applicant data is processed on behalf of the company. The data protection information of Google and Microsoft also applies.

13. Cookies and browser storage

Reclyra uses cookies for sign-in and session management as well as browser storage for selected settings and unsaved job drafts in the current tab. Insofar as storage or access is strictly necessary for a digital service expressly requested, no consent is required for this under section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). The subsequent processing of personal data is governed in particular by Art. 6(1)(b) or (f) GDPR.

No analytics or marketing tracking services are integrated on the Reclyra website. There is therefore no choice for such services in a consent banner. The storage technologies actually used, their purposes and durations are explained in the cookie and storage notice.

14. Recipients and service providers

Depending on the feature used, personal data is transmitted to the following service providers:

• Vercel: hosting, website delivery, server-side application functions and AI Gateway. This concerns technical access data and the application content processed in the process and, when AI is used, also analysis requests and results. Information: privacy notice and DPA.
• Supabase: database and private file storage for accounts, workspaces, applications, documents and associated processes. Information: privacy policy and DPA.
• AI inference providers via Vercel AI Gateway: The CV analysis uses Claude Haiku 4.5, a model developed by Anthropic. The gateway selects the provider for model execution; the model name alone does not determine this recipient. Transmitted document text, criteria and analysis results are processed. For the explicitly requested business inbox assistant, this also includes the message excerpts, working instructions and text suggestions described above. Information: provider selection in AI Gateway.
• Resend (Plus Five Five, Inc.): technical delivery of platform and business emails, receipt of forwarded business emails and, where reply import is activated, receipt of applicant replies, including message and delivery data. Information: privacy policy and DPA.
• Stripe: payment and subscription processing with the customer, billing and transaction data required for this. Information: privacy policy.
• IONOS: business email mailboxes and associated messages, contact details and technical metadata. Information: privacy policy (German).
• Google or Microsoft: only in the case of an actively connected optional calendar integration, with the data described in the previous section.

Within a company, its authorised users receive data according to their roles and job permissions. Further recipients may be necessary legal, tax or IT service providers as well as authorities and courts, insofar as this is necessary for handling a specific matter or on the basis of legal obligations.

15. Processing outside the EEA

The services named may also process data outside the European Economic Area or make it accessible to service providers and support functions there. This concerns in particular processing in the USA by Vercel, Resend and when the Anthropic model is used. In its provider documentation, Resend names the USA as its primary processing location. A European storage region likewise does not mean exclusively European processing of all operational and support data.

Transfers to third countries are subject to the requirements of Art. 44 et seq. GDPR. The public data processing terms of Vercel, Supabase and Resend linked above describe, among other things, standard contractual clauses of the European Commission for this purpose. You can request information on the safeguards relating to a specific processing operation and an accessible copy via our data protection contact.

16. Criteria for the storage period

Retention is determined by category of data and purpose. The decisive factors are the duration of the respective process and of the contractual relationship, open requests or disputes, statutory retention obligations and the necessity of specific security and legal records. Storage for another purpose requires its own basis.

For applicant data, the responsible company decides on the required duration and deletion instruction. The period that can be selected in the product is not a legally prescribed applicant retention period. Platform accounts, service provider logs, email mailboxes and backup copies are not automatically subject to the same period as an application.

A terminated pilot or contract and an account suspension are not confirmation that all data has already been deleted. For the return and removal of data processed on behalf of the customer, the company's instruction, the associated agreement and the systems concerned are decisive. If you have questions about specific storage or a deletion, you can reach us via the data protection contact.

17. Provision of data

Certain information is required for registration, sign-in, contract performance or billing. Without this data, the service concerned cannot be provided or can only be provided to a limited extent. Voluntary information is not a prerequisite for use unless it is required for the feature expressly requested. Only enter information that is necessary for the respective purpose. Mandatory information in an application is determined by the responsible company.

18. Your rights

Subject to the respective statutory requirements, you have the following rights:

• access under Art. 15 GDPR;
• rectification under Art. 16 GDPR;
• erasure under Art. 17 GDPR;
• restriction of processing under Art. 18 GDPR;
• data portability under Art. 20 GDPR;
• objection under Art. 21 GDPR;
• withdrawal of consent under Art. 7(3) GDPR with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected;
• lodging a complaint with a data protection supervisory authority under Art. 77 GDPR.

Objection in the case of legitimate interests: Insofar as processing is based on Art. 6(1)(f) GDPR, you can object on grounds relating to your particular situation. In the case of direct marketing, there is a right to object at any time without giving particular reasons.

Please send requests concerning Reclyra's own processing to privacy@reclyra.app. In the case of a specific application, the responsible company is your first point of contact. To avoid unauthorised disclosure, an appropriate verification of your identity may be necessary. Please do not send a copy of your identity document unsolicited.

19. Complaints and supervisory authority

You can lodge a complaint in particular with a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement. For Reclyra as a business in Baden-Württemberg, the competent authority is, in principle, the state data protection supervisory authority there:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information Baden-Württemberg).

20. Changes to this policy

This policy is adapted to changes in the processing, the services used and the legal requirements. The date stated above identifies the respective version.