Privacy Policy

1. Data controller

COSMIC TOMORROW (trading as RECRU)

Tax ID: 519123069

Registered address: R. Alfredo Allen n.º 455 461, 4200-135 Porto, Portugal

Contact email: privacy@recru-app.com

With regard to the processing of candidate data managed by our clients, RECRU acts as a data processor under Article 28 of the GDPR, as formalised in the Data Processing Agreement (DPA) signed with each client.

2. Data we collect

We collect the following data from our business (B2B) clients:

• Contact's first and last name
• Company name
• Business email address
• Number of recruiters on the team
• Platform usage data (logs, interactions)

3. Purpose of processing

• Provision of the contracted service
• Management of the commercial relationship
• Sending service-related communications
• Improving and personalising the platform
• Compliance with legal obligations

4. Legal basis

• Performance of a contract: to provide the service
• Legitimate interest: for product improvements and related commercial communications
• Consent: for the use of non-essential cookies and marketing communications
• Legal obligation: to comply with applicable regulations

5. Data recipients

Your data may be shared with:

• Supabase Inc. (USA, servers in the EEA) — database infrastructure, authentication and file storage
• Twilio Inc. (SendGrid, USA) — sending transactional email communications
• Resend Inc. (USA) — sending screening emails
• Deepgram Inc. (USA) — real-time voice transcription during interviews
• Google LLC / Gemini (USA) — artificial intelligence features (document generation, CV analysis, automated reports)
• Legal and accounting advisors, where necessary

We do not sell or transfer data to third parties for commercial purposes.

6. International transfers

The following providers are located in the United States and act as sub-processors. All transfers are carried out under the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914), which guarantee a level of protection equivalent to that required by the GDPR:

• Twilio Inc. (SendGrid) — transactional email
• Resend Inc. — screening email
• Deepgram Inc. — voice transcription
• Google LLC (Gemini) — artificial intelligence

Supabase Inc. operates with servers located within the European Economic Area.

7. Retention periods

Data will be retained for the duration of the contractual relationship and, once terminated, for the legally required periods. After an account is cancelled, data will be deleted within a maximum of 30 days, unless there is a legal obligation to retain it. Data from leads who do not sign up for the service will be deleted within a maximum of 12 months from the last contact.

8. Data subject rights

You may exercise your rights of:

• Access, rectification and erasure
• Restriction of and objection to processing
• Data portability
• Withdrawal of consent

To exercise these rights, write to us at privacy@recru-app.com. You also have the right to lodge a complaint with the CNPD (Comissão Nacional de Proteção de Dados) in Portugal or with the competent supervisory authority.

9. Security

We apply appropriate technical and organisational measures to protect your data, including encryption in transit (TLS) and at rest, access controls and continuous monitoring.

10. Changes

We reserve the right to update this policy. Any change will be notified to registered users and published on this page with the update date.