DRAFT for review by counsel. Not legal advice.

CG Recruit Privacy Policy

Effective date: [EFFECTIVE DATE]

This policy explains how MYCG AI TECH LLC ("we", "us"), a Kentucky limited liability company, handles personal information in CG Recruit, a product of MyCG.AI.

1. Two roles

For our customers' account users (recruiters, admins and other staff of staffing firms), we decide how their information is used. This policy applies directly.
For candidates, references and vendor contacts whose details our customers load into or collect through CG Recruit, the staffing firm decides how that information is used. The firm is the controller and we process the data on its behalf under our Data Processing Addendum. If you are a candidate, please contact the staffing firm that contacted you first. We will help them respond.

2. What we collect

Account users: name, work email, role, company, login and security data, billing contact details (card details are handled by Stripe, not stored by us), and how you use the app.

Candidates, on behalf of our customers:

Resume content: name, contact details, location, work history, skills, education, certifications.
Messages exchanged with the recruiter by email or text, and AI readings of replies (for example interested, not interested, opt out).
Written screening answers, and integrity signals collected during the screening: paste events and pasted character counts, tab or window switches, keystroke counts and time taken per answer. We show a notice and ask for consent before the screening starts.
Work authorization details read from a document you upload: document type, category, name on document, validity dates, employer if shown. The uploaded file is discarded after it is read. Only the extracted fields are kept.
Right to represent (RTR) confirmations: the name you type, the time, your IP address and your browser user agent.
Optional comparison between the resume and a LinkedIn profile, where the recruiter provides it.

References: name, email, company, relationship, and the answers they give.

Vendor contacts: name, email, company and the requirement emails they send.

3. How we use it

To provide the service: parse resumes and requirements, match, draft messages, run screenings, record RTRs and references, and prepare submissions.
To secure the service, prevent abuse and keep audit logs.
To support, bill and communicate with account users.
To meet legal obligations.

We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use customer or candidate data to train AI models.

4. AI processing

CG Recruit sends resume text, requirement text, messages, screening answers and uploaded documents to Anthropic (Claude) to produce structured data, scores and drafts. Anthropic processes this data as our sub-processor and does not use it to train its models. AI output can be wrong, and a human at the staffing firm is expected to review it before acting.

5. Who we share with

Service providers that help run CG Recruit: Vercel (hosting), Supabase (database and authentication), Anthropic (AI), Resend (email), Stripe (payments), Twilio (text messages). The current list is in our Data Processing Addendum.
The staffing firm that holds your data, and the vendors or clients it submits you to, as directed by that firm.
Authorities, if the law requires it, or to protect rights and safety.
A buyer or successor, if our business is sold or merged, under the same protections.

Mobile numbers and text messaging opt in data are never shared with third parties or affiliates for marketing or promotional purposes.

6. Where data is stored

Data is stored and processed in the United States.

7. How long we keep it

Customer Data is kept while the customer's account is active and deleted within [30] days after it closes, except backups, which roll off within [35] days, and records we must keep by law.
Customers can delete individual candidates, which removes their resume, messages, screenings and related records.
Work authorization files are not kept at all. Extracted fields are kept until the customer deletes the candidate.
Opt out records are kept so we can keep honoring them.

8. Security

We use encryption in transit, encryption at rest by our hosting providers, per-company data isolation enforced in the database, role-based access, and audit logs. No system is perfectly secure. We will notify affected customers of a security incident as the law and our DPA require.

9. Your choices and rights

Opt out of messages: reply STOP to any text, or use the unsubscribe link in any email.
Access, correction, deletion and other rights: depending on your state (for example California, Colorado, Connecticut, Virginia and others), you may have rights to know, access, correct, delete or port your data, and to appeal a refusal. Candidates should contact the staffing firm first. You can also write to [PRIVACY EMAIL] and we will route your request.
California: we do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information to infer characteristics. [COUNSEL: confirm CCPA notice at collection wording for candidates and employees of customers.]
We will not discriminate against you for exercising your rights.

10. Children

CG Recruit is for business use and is not directed to anyone under 18.

11. Changes

We will post changes here and update the effective date. For material changes we will notify account users by email or in the app.

12. Contact

MYCG AI TECH LLC, [ADDRESS]. Privacy questions: [PRIVACY EMAIL]. Support: [SUPPORT EMAIL].