Privacy Policy

Last updated: September 19, 2026 — Version 2.1 (clarifications on Google and Microsoft data)

1. Data controller

The data controller is Profiliotech SRL, a company governed by Belgian law, BCE BE 1005.260.389, with its registered office in Belgium. For any question about data protection, contact adellaira@profiliotech.com.

When you use Profilio to manage candidates and contacts as part of your recruitment business, you are yourself the data controller for the data you import, and Profilio acts as a processor within the meaning of Article 28 GDPR. A data processing agreement (DPA) is available on request.

2. Scope

This policy applies to:

• The web platform profiliotech.com (CRM, ATS, billing, analytics, team chat, video interviews)
• The progressive web app (PWA) that can be installed from the platform
• The Chrome extension "Profilio — Import LinkedIn 1-clic"
• Shareable public pages (client shortlists, candidate interviews, job postings, DISC tests, contract signing)

3. Recruiter user data

When a recruiter account is created and while it is used, we process:

• Identity & contact : last name, first name, business email address, phone number, optional profile photo
• Authentication : hashed password (via Supabase Auth, bcrypt algorithm), session tokens, OTP codes sent by SMS/email
• Organization : company name, BCE/VAT number, billing address, IBAN for issuing invoices
• Subscription & payment : plan subscribed to, billing history, managed via Stripe (we do not store any bank card numbers)
• Usage data : activity logs (calls made, emails sent, placements made) for the team's internal KPIs
• Communication settings : assigned Telnyx number, Gmail/Outlook OAuth credentials if email sync is enabled

4. Candidate and CRM contact data

As a recruitment agency using Profilio, you import and manage data on candidates, client contacts and prospects. This data may include:

• Identity and contact: last name, first name, email, phone, address, date of birth where applicable
• Career history: CV, cover letters, experience, education, skills, current salary and salary expectations
• Assessments: DISC test results, technical tests, interview reports, AI scoring, client feedback
• Communications exchanged: emails, SMS, calls (metadata and recordings), interview videos
• Documents: CVs, portfolios, diplomas, signed contracts, commercial proposals
• Public LinkedIn data imported via the extension, via Waalaxy or via the LinkedIn integration: identity, job title, company, experience, declared skills, profile photo
• Contact details the person has chosen to make visible to their LinkedIn connections (personal email address, phone number), read only when they are a 1^st degree connection of the recruiter
• LinkedIn and WhatsApp conversations between the recruiter and the person, as well as connection requests sent and received
• Enrichment performed via FullEnrich or Lusha (business email, phone number)

4.1 Recruiter obligations

As the data controller for candidate data, you undertake to:

• Inform candidates of the collection and processing of their data
• Have a valid legal basis (consent, legitimate interest, contract)
• Honor the rights of access, rectification and erasure upon first request
• Not import sensitive data (health, political opinions, sexual orientation…) unless there is an explicit legal basis

4.2 Linked LinkedIn, WhatsApp and email accounts

A recruiter can link their LinkedIn account, WhatsApp number and business email to Profilio. This link goes through Unipile, a provider based in France, which acts as a technical gateway.

• Authentication : the recruiter authenticates directly with LinkedIn, Google or Microsoft, on their own pages. Their credentials never pass through Profilio and are never stored by us.
• Scope : the link is personal and voluntary. It can be revoked at any time from the settings, in one click, without any action on our part.
• What is read : conversations with candidates and contacts, connection requests, profiles viewed, 1^st degree connections, jobs posted and applications received.
• What is not kept : private conversations unrelated to a CRM record are not stored. A message whose sender or recipient does not match any candidate or contact is ignored.
• Contact details of 1^st degree connections : when a person is connected with the recruiter, LinkedIn shows the recruiter the contact details that this person has chosen to share with their connections. Profilio may copy them into the record. No hidden data is circumvented.
• Pace : automated actions (invitations, profile views) are capped and spaced out, in compliance with the terms of use of the platforms concerned.

5. Chrome extension for LinkedIn

The Chrome extension "Profilio — Import LinkedIn 1-clic" lets you import a LinkedIn profile into your CRM via a button injected on profile pages.

• Technical permissions : storage (save the local session token) and alarms (clean up scheduled tasks from previous versions, only when you click the button)
• Domains involved : linkedin.com for reading only, ilxmjbuvivfvklvdriqk.supabase.co for sending the data to your CRM
• Data read : last name, first name, title, current company, location, experience, education, skills, public profile URL
• Trigger : only on a manual action (click) by the user. The extension collects no data in the background, tracks no browsing, and reads no LinkedIn data outside explicitly imported profile pages
• Analytics : no third-party telemetry (no Google Analytics, no tracking)

6. Artificial intelligence processing

Profilio uses artificial intelligence models to speed up recruiters' work. The processing operations are as follows:

• CV parsing : structured extraction of a CV (PDF, Word) into candidate fields (OpenAI)
• Semantic candidate/job matching : vector embeddings of job descriptions and candidate profiles (OpenAI text-embedding-3-small, stored in Supabase pgvector)
• Call analysis : automatic transcription and summary of calls (only if recording is enabled by the recruiter)
• Content generation : job descriptions, commercial proposals, email messages — always subject to human review before sending
• Technical & DISC tests : generation and analysis of custom tests

Data sent to OpenAI is not used for training their models (OpenAI "Data Processing Addendum" option enabled). We strictly limit the data sent to the minimum needed for the task.

7. Calls, emails and interview videos

7.1 Phone calls (Telnyx)

Outgoing and incoming calls made from Profilio go through Telnyx, a certified telecom operator. Metadata (number, duration, date) is kept for billing and activity tracking. Audio recording is disabled by default and can only be enabled with the consent of the parties to the call, in accordance with Belgian regulations.

7.2 Email sync (IMAP / OAuth)

If you enable Gmail or Outlook sync, Profilio accesses your mailbox via OAuth 2.0 (never by password). Only emails linked to a contact or job in your CRM are indexed in the platform. You can revoke access at any time from your Google/Microsoft settings.

7.2.1 Google data (Gmail and Google Calendar) — limited use

When you connect a Google account, Profilio requests the following permissions, and only these:

• Reading emails (gmail.readonly) and IMAP access (mail.google.com, required by Google for IMAP sync via OAuth): display in a candidate's or contact's record the emails you have exchanged with them. Only messages whose sender or recipient is in your CRM are copied (subject, body, date, attachments); the others are neither read by a human nor kept.
• Sending emails (gmail.send): send, from Profilio and with your address, the emails you write or that the autopilot prepares for you, and archive them in the CRM.
• Calendar (calendar.events, calendar.readonly): create in your calendar the interviews and meetings scheduled in Profilio, and read your availability to suggest time slots.
• Identity (openid, email, profile): recognize your address and display your name.

Profilio's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its requirements forlimited use (Limited Use): this data is used only to provide the features described above, which are visible to you; it is never sold, never used for advertising, never passed on to third parties other than the technical processors listed in section 9 (hosting), and never used to train general-purpose artificial intelligence models. Access tokens are encrypted at rest, hosted in the European Union (Frankfurt), and deleted as soon as you disconnect the account (Settings → Email sync) or revoke access from your Google account (myaccount.google.com/permissions). Emails already copied into your CRM remain subject to the retention rules in section 11 and can be deleted on request.

7.2.2 Microsoft data (Outlook and Microsoft 365 calendar)

The same rules apply to the Microsoft Graph permissions requested (Mail.ReadWrite, Mail.Send, User.Read, offline_access, calendar): reading emails linked to your CRM contacts, sending on your behalf, creating meetings, no other use. Revocable at any time from myapps.microsoft.com or in Profilio.

7.3 Candidate interview videos

Candidates invited to record a video interview are informed before recording (duration, number of questions, recipient). Videos are stored on Supabase Storage (bucket video-interviews, AWS Europe infrastructure), accessible only to members of the organization that created the invitation. The candidate can request deletion at any time.

7.4 Team chat

Internal chat messages are stored in the Supabase database and are accessible only to members of the organization. No indexing or AI analysis is performed on message content.

7.5 Claude connector (MCP)

The Profilio connector lets a recruiter use their Profilio account from Claude (Anthropic). It is only activated at the recruiter's request: they add it in Claude, sign in on Profilio's authorization page and authorize access, which covers managing their account within the limits of their organization's plan.

• Accessible data : only the data the recruiter can already see in Profilio, with their permissions and within their organization (candidates, contacts, client companies, jobs, pipeline, calendar, linked emails). No data from any other agency.
• Data sent to Claude : only the results of the tools Claude calls to answer the recruiter's request. Their processing by Anthropic falls under the recruiter's Claude account and the Anthropic privacy policy. Profilio does not receive the content of Claude conversations.
• Data kept by Profilio : no token (it is issued by our authorization server, hosted in the EU, and kept by Claude); the date of the authorization, and a technical log of calls (tool called, parameters, result, duration), viewable by the recruiter and their organization's administrator, kept for 12 months for security and support purposes.
• No resale or reuse : this data is not used for advertising, to train AI models, or for any purpose other than carrying out the request.
• Safeguards : no deletion or anonymization tool is exposed; bulk sends are capped; write actions follow the recruiter's permissions and their organization's plan.
• Revocation : at any time, in Claude (Settings → Connectors → Profilio → Disconnect), or on the Profilio side from the connector page ("View and remove access"): Claude then loses access immediately.
• Contact : adellaira@profiliotech.com.

8. Purposes and legal bases

9. Processors and transfers outside the EU

To provide the service, we use the following processors, bound by standard contractual clauses (SCC) where necessary:

We never sell, rent or share your data for advertising or commercial purposes with third parties not listed above.

10. Security and hosting

• Primary hosting : Supabase on AWS Europe (Frankfurt, Germany), ISO 27001 and SOC 2 compliant
• Encryption : TLS 1.3 in transit, AES-256 at rest
• Data isolation : each organization is isolated via PostgreSQL Row-Level Security (RLS) policies — a user technically cannot access another organization's data
• Access : mandatory authentication, time-limited sessions, OTP available
• Backups : encrypted daily backups, 7-day retention
• Logging : logs of access and sensitive actions (deletion, export) kept for 12 months
• Security testing : regular audits, vulnerability monitoring via Supabase Advisors

11. Retention period and deletion

When your subscription ends, you can export all your data (candidates, jobs, contacts) using the GDPR Export feature available in the settings.

12. Your GDPR rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights:

• Right of access : obtain a list of the data concerning you
• Right to rectification : correct inaccurate data
• Right to erasure ("right to be forgotten")
• Right to data portability : export in JSON/CSV format
• Right to object to processing on legitimate grounds
• Right to restriction of processing
• Right not to be subject to a fully automated decision : no recruitment decision is made automatically by our AI — it always remains under human control
• Right to withdraw your consent at any time

To exercise these rights, contact adellaira@profiliotech.com. We will respond within 30 days at most.

Candidates stored in a client's CRM can also contact the recruitment agency concerned directly, as it is the data controller for their data.

13. Cookies and local storage

The Profilio platform only uses cookies and storage mechanisms that are strictly necessary for it to work:

• Supabase session (localStorage): keeps you signed in
• Interface preferences (localStorage): theme, filters, view
• Service Worker (PWA): caching of assets for offline mode
• Push notifications : subscription via the browser's Web Push API (with explicit consent)

On the public website (profiliotech.com), and only if you click "Accept" in the banner, the Google tag (Google Ads) sets measurement and advertising cookies: it lets us know whether an ad led to a demo booking. Without your consent, no advertising cookie is set and Google only receives anonymous signals with no identifier. Your choice is stored in your browser; you can change it at any time by reopening the banner. In the signed-in application, no advertising cookies, no Facebook pixel and no Google Analytics are used. The Chrome extension uses no cookies.

14. Minors

Profilio is a professional tool intended for adult recruiters. We do not knowingly collect data about people under 16. If you notice any such data, contact us for immediate deletion.

15. Changes

We reserve the right to change this policy to reflect technical or regulatory developments. In the event of a substantial change, you will be informed by email at least 15 days before it takes effect, as well as by a notification in the application.

16. Contact and complaints

For any question, request to exercise a right or incident report:

If, after contacting us, you believe your rights are not being respected, you can lodge a complaint with theData Protection Authority (DPA) (Belgium):

• Rue de la Presse 35, 1000 Bruxelles
• Tel.: +32 (0)2 274 48 00
• www.autoriteprotectiondonnees.be