Recruiti AI

Recruiti AI

Privacy Policy

See also our Terms of Service and Data Processing Agreement.

Last Updated: October 3, 2026

Recruiti AI ("Recruiti AI", "we", "us" and "our") is a company registered in the Republic of Lithuania. This notice explains how we handle personal data when you use the Recruiti AI interview platform at recruiti.io (the "Platform"), visit our website, or appear in an interview a customer records with the Platform.

In this notice, "personal data", "processing", "controller", and "processor" have the meanings in the General Data Protection Regulation ((EU) 2016/679) ("GDPR").

1. Our roles

Recruiti AI is:

  • the controller for personal data of account holders, people who request access, website visitors, and people who contact us about billing, support, analytics, or marketing; and
  • the processor for interview content our customers submit or record (recordings, transcripts, summaries, and related participant data). The customer decides why that data is processed. That processing is covered by our Data Processing Agreement.

2. What we collect

What we collect depends on how you interact with us.

  • Account and access requests: name, email address, login credentials, plan, and the record that you accepted the Terms of Service.
  • Interviews: participant names, job titles where the customer provides them, audio and video recordings, transcripts, AI-generated summaries, speaker labels, and meeting metadata (date, duration, and title).
  • Google Calendar, if you connect it: see below.
  • Support and billing: the content of messages you send us, and payment details held by our payment provider when you pay online.
  • Website and product use: IP address, browser and device data, and cookie data described below. Analytics data is collected only after you accept analytics cookies.

Interview data is provided by the customer who uses the Platform, or captured when that customer sends our recording bot into a meeting. We do not connect to an employer's applicant-tracking system.

Google Calendar

If you choose to connect your Google Calendar, we request read-only access via Google's OAuth API, using the single https://www.googleapis.com/auth/calendar.events.readonly scope. We request no other Google scopes. We use that access to list events on your primary calendar within a bounded window of upcoming and recently past events, and to register change notifications so the Platform stays up to date. We do not create, edit, or delete events on your Google Calendar. For each event in that window we store:

  • the date, time, title, and status of the event;
  • the conferencing link, when Google Meet, Zoom, or Microsoft Teams is detected. We inspect structured conferencing data and, when necessary, the location and description fields, and we store only the join link; and
  • the attendee list (names and email addresses, where Google provides them), used to help identify speakers.

We use this data to show your meetings, let you turn recording on or off when a supported link is present, and schedule the bot. We do not use Google Calendar data for advertising. Calendar data shown in the Platform is kept only as long as needed to show upcoming and recent meetings, and is replaced or deleted on each sync. You can disconnect in Platform settings or from your Google Account permissions. Disconnecting stops future reads. It does not delete transcripts or summaries already created.

Recruiti AI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. How we use personal data

Where we are the controller, we use personal data to:

  • create and secure your account and provide the Platform;
  • produce transcripts and summaries so your team can review interviews;
  • answer support requests and keep financial records;
  • send product messages that are similar to a service you already use, where the law allows that without consent, and other marketing only with consent;
  • keep the Platform secure and understand how it is used; and
  • comply with law.

AI outputs are drafts for human review. We do not make decisions that produce legal effects or similarly significant effects about a person solely by automated means (GDPR Article 22). You must not treat an AI summary as the sole basis for a hiring decision.

We do not use the content of interview recordings or transcripts to train AI models, and we do not share that content with third parties for their own purposes. We may use aggregated or de-identified usage data to operate and improve the Platform.

4. Legal bases

For people in the EEA, we rely on:

  • Contract (Article 6(1)(b)) to provide the Platform you or your organisation asked for, including the recording bot, transcripts, summaries, and your account.
  • Legitimate interests (Article 6(1)(f)) for security, fraud prevention, aggregated analytics, and messages about similar products to existing customers. You can object, including to those messages, at privacy@recruiti.io.
  • Legal obligation (Article 6(1)(c)) for financial records and lawful requests from authorities.
  • Consent (Article 6(1)(a)) for analytics cookies and for marketing to people who are not existing customers. You can withdraw consent in cookie settings, by disconnecting an integration, or by emailing us. Withdrawal does not affect processing that was already lawful.

Recordings and transcripts may incidentally include special-category data (GDPR Article 9), such as health information a candidate mentions. We do not ask for that data. Customers, as controllers of their recruitment process, are responsible for any extra legal basis and safeguards.

5. Who we share data with

We share personal data with service providers who process it for us:

  • hosting and database (Supabase, Vercel);
  • the meeting bot (Recall.ai) and speech-to-text (Soniox);
  • AI processing for summaries, embeddings, and answers (OpenAI);
  • email delivery (Resend) and, if you connect it, Slack;
  • analytics after you accept cookies (PostHog, hosted in the EU; Google Tag Manager and Google Analytics);
  • payment processors, when you pay online; and
  • professional advisers, and authorities when the law requires it.

We do not sell personal data. A current list of sub-processors is available on request at privacy@recruiti.io. We will tell customers about intended additions or replacements before the new sub-processor begins processing their personal data, as described in the Data Processing Agreement.

If we sell or transfer the business, personal data may transfer with it. We would tell account holders before that happens where the law requires notice.

6. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, or disclosure. Depending on the data and risk, these measures may include encryption, access controls, logical separation of customer data, protected integration credentials, and security monitoring. We review and update safeguards as the Services and risks evolve.

Access to recordings and other sensitive content is restricted and may use time-limited links. We do not intentionally publish customer recordings at permanent public addresses.

We maintain procedures for responding to personal data breaches and will notify customers, supervisory authorities, or affected people where and when applicable law requires.

7. International transfers

Some providers process personal data in the United States or another country outside the EEA. PostHog product analytics is hosted in the EU. Where we transfer personal data from the EEA to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses (Decision 2021/914) and, where the provider is certified, the EU-US Data Privacy Framework. You can ask for a copy of the relevant safeguard at privacy@recruiti.io.

8. Cookies

Essential cookies run the Platform. Analytics cookies load only if you choose Accept. You can change that choice at any time via .

  • recruiti_consent — stores Accept or Essential only, for 180 days.
  • recruiti_locale — stores your language choice (English or Lithuanian) for 1 year. Your browser's language setting is also used to choose the homepage language. That setting is not stored.
  • Supabase authentication cookies (names beginning with sb-) — keep you signed in for the session.
  • tz — your timezone for the calendar, for 1 year.
  • calendar-view — list or week view, for 1 year.
  • sidebar-collapsed — dashboard layout, for 1 year.
  • Analytics cookies from Google Tag Manager, Google Analytics, and PostHog — only after you accept, for the periods those providers set.

Light or dark appearance is stored in your browser's local storage, not in a cookie. Blocking essential cookies may stop sign-in.

9. How long we keep data

Recordings, transcripts, and summaries are kept while the account is active. You can delete them at any time. On the Free plan, interview history older than 14 days is not shown in the product and is not used for search. That is an access window, not a deletion. The content stays until you delete it or the account is closed.

Google Calendar event data shown in the Platform is kept only as needed for current and recent meetings and is refreshed or deleted on each sync.

On account closure we make your content available for export for 90 days, then delete it, except where the law requires us to keep it (for example financial records). Disconnecting Google stops further calendar reads immediately.

10. Your rights

If you are in the EEA or UK, you can ask us to access, correct, erase, or restrict personal data, to object to processing, and to receive data you provided in a portable format. We may verify your identity. We do not charge a fee unless a request is manifestly unfounded or excessive.

If you are a candidate in a recorded interview, contact the employer or agency that recorded it first. They are the controller. If you cannot reach them, email privacy@recruiti.io and we will help where we can.

Marketing is sent to existing customers on the basis of legitimate interests, and to anyone else only with consent. You can opt out at any time at privacy@recruiti.io.

You can complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, VDAI), L. Sapiegos g. 17, LT-10312 Vilnius, vdai.lrv.lt, or to the authority where you live. Please contact us first so we can try to resolve it.

If you are a California resident, you may request to know, delete, or correct personal information, and to opt out of sale or sharing. We do not sell or share personal information for cross-context behavioural advertising. Email privacy@recruiti.io.

11. Children

The Platform is not for anyone under 18. We do not knowingly collect personal data from children. If you believe we have, email privacy@recruiti.io and we will delete it.

12. Changes

We will post changes on this page and, where appropriate, email account holders. The date at the top is the date of the latest change.

13. Contact

Recruiti AI
Republic of Lithuania
Privacy: privacy@recruiti.io
Support: support@recruiti.io

Recruiti AI · recruiti.io · privacy@recruiti.io