Privacy & Cookies Policy

This Policy explains how HRGuru processes personal data of website visitors, Company users (recruiters/employers), and Candidates using our CV Builder. For candidate data inside an employer's hiring pipeline, HRGuru acts as a processor — see the DPA.

HRGuru ("we", "us", "our") is an AI-powered recruitment platform operated by Ganna Razheva, registered in Moldova, registration number 2024810615405. Data-protection contact: privacy@hrguru.work.

This Policy applies to visitors to hrguru.work, Company users, Candidate users, and candidates whose data is processed on behalf of our B2B clients. Terms such as "personal data", "processing", "controller", "processor" and "supervisory authority" have the meanings given in the GDPR, Moldova Law No. 133/2011 (and Law No. 195/2024 from 23 August 2026), and Ukraine Law No. 2297-VI, each as applicable.

Jurisdiction. We apply the data-protection standard applicable to your jurisdiction. Where we operate across regions, we aim to meet the higher of the applicable EU, Moldovan, Ukrainian and US-state requirements that apply to you.

1. Who we are and our role

Where HRGuru is a processor, the employer is the controller, its own privacy notice governs that processing, and our obligations are set out in the Data Processing Agreement (DPA).

2. Data we collect

2.1 Company users (HR / recruiters)

• Name, work email, phone, job title — legal basis: contract (Art. 6(1)(b)) — retention: contract + 2 years.
• Operational login logs, IP address — legitimate interest (Art. 6(1)(f)) — 12 months.
• Billing details — contract + legal obligation — as required by accounting law.
• Support communications — contract / legitimate interest — 3 years.
• Access requests from personal (non-corporate) email addresses — when a company account is registered with a personal mailbox, the email, company name and LinkedIn profile link you provide, used only to verify that you represent a company before access is granted — legal basis: steps prior to entering into a contract (Art. 6(1)(b)) and legitimate interest in preventing fraudulent sign-ups (Art. 6(1)(f)) — retention: until the request is decided; if rejected, deleted 30 days after the decision (together with the account, if it holds no other data); if approved, kept as part of the company account.

2.2 Candidates (direct CV Builder users)

• Name, email, phone, location — contract/consent — until account deletion.
• CV content (work history, skills) — contract — until deletion + 30 days.
• Job applications, stage history — contract — 2 years.
• Usage analytics — consent (cookie) — 13 months.

2.3 Candidates processed for B2B clients

When our B2B clients upload CVs or receive applications, the hiring company is the controller and HRGuru is the processor under Art. 28 GDPR. We process CV text for AI scoring, AI-generated scores and analysis, stage history and recruiter notes, and extracted metadata. We do not process biometric data, photos, video, or protected characteristics. Our AI evaluates skills and experience only.

2.4 Sourced candidates (from job boards and public profiles)

Where a client sources candidates from third-party platforms (e.g. rabota.md, delucru.md, work.ua, LinkedIn) via integrations or our browser extension, the client is the controller and is responsible for the lawfulness of that sourcing. Where personal data is obtained indirectly, the controller must provide the information required by GDPR Art. 14 within the prescribed time. HRGuru does not warrant the accuracy or lawfulness of data obtained from third-party sources.

2.5 Third-party sign-in (Google, Microsoft and LinkedIn)

HRGuru offers optional sign-in using your Google account, your Microsoft (Entra ID / Microsoft 365) account or your LinkedIn account, provided through Supabase Auth (our authentication processor).

What we access. When you sign in with Google, we request only the basic OpenID Connect scopes openid, email and profile. From these we receive your name, email address, profile picture (if available) and Google account identifier. We do not request access to Gmail, Google Drive, Google Calendar, Google Contacts or any other sensitive or restricted Google data. When you sign in with Microsoft, we request only the basic scopes openid, email, profile and (for session renewal) offline_access, together with the User.Read permission. From these we receive your name, email address, basic directory profile (which may include display name, given name, surname, job title, business phone, office location, preferred language and user principal name) and Microsoft account identifier. We do not request access to your mailbox, files, calendar or other Microsoft 365 content. When you sign in with LinkedIn, we request only the OpenID Connect scopes openid, profile and email. From these we receive your name, email address, profile picture (if available) and LinkedIn member identifier. We do not request access to your connections, messages, posts or any other LinkedIn data.

How we use it. Solely to create and secure your HRGuru account, authenticate you at each sign-in, populate your user profile, and contact you about the service. We do not use it for advertising.

How we store and secure it. This data is stored in our Supabase-managed database, encrypted in transit (TLS/HTTPS) and at rest. Access tokens are held only as long as needed to keep you signed in; we do not retain long-lived Google, Microsoft or LinkedIn access tokens beyond that purpose.

How we share it. We do not sell your data or share it with third parties for their own purposes. We share it only with the infrastructure sub-processors that operate HRGuru (currently Supabase), under contractual data-protection obligations, and where required by law.

Retention and deletion. We retain sign-in data while your account is active. You may delete your account and associated data at any time by emailing privacy@hrguru.work. You may also revoke HRGuru's access from your Google account (myaccount.google.com/permissions), your Microsoft account (myapps.microsoft.com) or your LinkedIn account (linkedin.com/psettings/permitted-services).

Apply with LinkedIn. On a company's careers page you can use "Apply with LinkedIn" to fill in your name and email from your LinkedIn account (same scopes as above). This does not create an HRGuru account and does not sign you in: only your name and verified email are kept, for at most 5 minutes in a temporary browser cookie, to pre-fill the form, and the LinkedIn access token is discarded straight away. Nothing is stored unless you submit the application, which is then processed as described in §2.3.

Google Limited Use. HRGuru's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. How our AI works — transparency notice

AI is decision-support, not a decision-maker. Our CV-scoring system is classified HIGH-RISK under EU AI Act Annex III, point 4(a) (recruitment). A human always makes the hiring decision.

What the AI does: parses CV text; compares the candidate profile against employer-defined role criteria; generates a 0–100 score, seniority classification and explanation; raises a "Controversial" flag (when evaluator spread exceeds 30 points) forcing mandatory human review.

What the AI does NOT do: it does not make the final decision; it does not use demographic or protected data; it does not learn from or store candidate data for third-party model training. The AI score is one input among several and is never the sole basis of a decision. HRGuru is designed so that AI scores are advisory and subject to human review. Where a score would nonetheless be relied on decisively (see CJEU C-634/21), candidates have the rights under GDPR Art. 22: to obtain human intervention, to express their point of view, and to contest the assessment — via the hiring company or privacy@hrguru.work.

Your rights regarding automated processing: to be informed, to human review (via the hiring company), to an explanation, and to object (EU/EEA, Art. 21). NYC candidates: HRGuru is an AEDT under NYC Local Law 144; hiring companies must conduct annual bias audits and provide notice.

4. Data retention

Why audit/decision logs are kept for 3 years. GDPR sets no fixed period; we justify retention against the limitation period for legal claims. Because AI-assisted hiring can give rise to discrimination or unfair-evaluation claims whose limitation periods exceed one year, we retain decision logs for 3 years for the establishment, exercise or defence of legal claims (GDPR Art. 17(3)(e)). Logs are minimised to identifiers and timestamps.

5. International data transfers

Our infrastructure is in the EU (Frankfurt, Germany). Sub-processors outside the EU/EEA use Standard Contractual Clauses (SCCs), and for Moldova the SCCs approved by the CNPDCP.

The current list is at hrguru.work/subprocessors. We give advance notice of changes and clients may object on reasonable data-protection grounds (see the DPA).

6. Cookies

We do not use Google Analytics, Facebook Pixel or behavioural advertising cookies. We honour the Global Privacy Control (GPC) signal.

7. Your rights

To exercise any right, email privacy@hrguru.work. We respond within one month (extendable to three for complex requests). First requests are free.

For data subjects in the Republic of Moldova, from 23 August 2026 these rights are exercised under Law No. 195/2024; the supervisory authority is the National Center for Personal Data Protection (CNPDCP, datepersonale.md).

8. California residents — CCPA / CPRA

California residents have the rights to know, delete, correct, opt out of sale/sharing, limit use of sensitive personal information, and non-discrimination. HRGuru does not sell personal information and does not share it for cross-context behavioural advertising. Email privacy@hrguru.work with subject "CCPA Request"; we verify identity and respond within 45 days.

9. Supervisory authorities

• EU/EEA: your national DPA (via EDPB) — edpb.europa.eu
• Moldova: CNPDCP — datepersonale.md · +373 22 820 801
• Ukraine: Commissioner for Human Rights (Ombudsman) — ombudsman.gov.ua
• California: California Privacy Protection Agency — cppa.ca.gov

10. Contact and updates

Controller: Ganna Razheva. Privacy contact: privacy@hrguru.work. DPO: Ganna Razheva.

We notify registered users of material changes by email and post updates at hrguru.work/privacy. Available in EN, RO, UK and RU; the English version prevails in case of conflict.

Legal review required: complete all [bracketed] fields and have qualified counsel (Moldova/EU/Ukraine) confirm the final text before publication.