Effective [●] 2026 · Applies to: EU/EEA · Moldova · Ukraine · USA
Privacy & Cookies Policy
This Policy explains how HRGuru processes personal data of website visitors, Company users (recruiters/employers), and Candidates using our CV Builder. For candidate data inside an employer's hiring pipeline, HRGuru acts as a processor — see the DPA.
HRGuru ("we", "us", "our") is an AI-powered recruitment platform operated by Viktor Razhev, registered in Moldova. Data-protection contact: privacy@hrguru.work.
This Policy applies to visitors to hrguru.work, Company users, Candidate users, and candidates whose data is processed on behalf of our B2B clients. Terms such as "personal data", "processing", "controller", "processor" and "supervisory authority" have the meanings given in the GDPR, Moldova Law No. 133/2011 (and Law No. 195/2024 from 23 August 2026), and Ukraine Law No. 2297-VI, each as applicable.
Jurisdiction. We apply the data-protection standard applicable to your jurisdiction. Where we operate across regions, we aim to meet the higher of the applicable EU, Moldovan, Ukrainian and US-state requirements that apply to you.
1. Who we are and our role
Context
HRGuru role
Controller
Website visitors, marketing, cookies
Controller
Viktor Razhev
Company users (recruiters/employer staff)
Controller
Viktor Razhev
Candidate using the CV Builder (B2C)
Controller
Viktor Razhev
Candidate data in an employer's pipeline (B2B)
Processor
The employer (our client)
Where HRGuru is a processor, the employer is the controller, its own privacy notice governs that processing, and our obligations are set out in the Data Processing Agreement (DPA).
2. Data we collect
2.1 Company users (HR / recruiters)
Name, work email, phone, job title — legal basis: contract (Art. 6(1)(b)) — retention: contract + 2 years.
Job applications, stage history — contract — 2 years.
Usage analytics — consent (cookie) — 13 months.
2.3 Candidates processed for B2B clients
When our B2B clients upload CVs or receive applications, the hiring company is the controller and HRGuru is the processor under Art. 28 GDPR. We process CV text for AI scoring, AI-generated scores and analysis, stage history and recruiter notes, and extracted metadata. We do not process biometric data, photos, video, or protected characteristics. Our AI evaluates skills and experience only.
2.4 Sourced candidates (from job boards and public profiles)
Where a client sources candidates from third-party platforms (e.g. rabota.md, delucru.md, work.ua, LinkedIn) via integrations or our browser extension, the client is the controller and is responsible for the lawfulness of that sourcing. Where personal data is obtained indirectly, the controller must provide the information required by GDPR Art. 14 within the prescribed time. HRGuru does not warrant the accuracy or lawfulness of data obtained from third-party sources.
2.5 Third-party sign-in (Google and Microsoft)
HRGuru offers optional sign-in using your Google account or your Microsoft (Entra ID / Microsoft 365) account, provided through Supabase Auth (our authentication processor).
What we access. When you sign in with Google, we request only the basic OpenID Connect scopes openid, email and profile. From these we receive your name, email address, profile picture (if available) and Google account identifier. We do not request access to Gmail, Google Drive, Google Calendar, Google Contacts or any other sensitive or restricted Google data. When you sign in with Microsoft, we request only the basic scopes openid, email, profile and (for session renewal) offline_access, together with the User.Read permission. From these we receive your name, email address, basic directory profile (which may include display name, given name, surname, job title, business phone, office location, preferred language and user principal name) and Microsoft account identifier. We do not request access to your mailbox, files, calendar or other Microsoft 365 content.
How we use it. Solely to create and secure your HRGuru account, authenticate you at each sign-in, populate your user profile, and contact you about the service. We do not use it for advertising.
How we store and secure it. This data is stored in our Supabase-managed database, encrypted in transit (TLS/HTTPS) and at rest. Access tokens are held only as long as needed to keep you signed in; we do not retain long-lived Google or Microsoft access tokens beyond that purpose.
How we share it. We do not sell your data or share it with third parties for their own purposes. We share it only with the infrastructure sub-processors that operate HRGuru (currently Supabase), under contractual data-protection obligations, and where required by law.
Retention and deletion. We retain sign-in data while your account is active. You may delete your account and associated data at any time by emailing privacy@hrguru.work. You may also revoke HRGuru's access from your Google account (myaccount.google.com/permissions) or your Microsoft account (myapps.microsoft.com).
Google Limited Use. HRGuru's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
3. How our AI works — transparency notice
AI is decision-support, not a decision-maker. Our CV-scoring system is classified HIGH-RISK under EU AI Act Annex III, point 4(a) (recruitment). A human always makes the hiring decision.
What the AI does: parses CV text; compares the candidate profile against employer-defined role criteria; generates a 0–100 score, seniority classification and explanation; raises a "Controversial" flag (when evaluator spread exceeds 30 points) forcing mandatory human review.
What the AI does NOT do: it does not make the final decision; it does not use demographic or protected data; it does not learn from or store candidate data for third-party model training. The AI score is one input among several and is never the sole basis of a decision. HRGuru is designed so that AI scores are advisory and subject to human review. Where a score would nonetheless be relied on decisively (see CJEU C-634/21), candidates have the rights under GDPR Art. 22: to obtain human intervention, to express their point of view, and to contest the assessment — via the hiring company or privacy@hrguru.work.
Your rights regarding automated processing: to be informed, to human review (via the hiring company), to an explanation, and to object (EU/EEA, Art. 21). NYC candidates: HRGuru is an AEDT under NYC Local Law 144; hiring companies must conduct annual bias audits and provide notice.
4. Data retention
Data type
Default retention
Configurable?
Deletion method
Candidate CVs (B2B)
365 days from upload
Yes (30–730 days)
Auto-deleted; score anonymised
AI scores and analysis
Same as CV
Yes
Anonymised; aggregate retained
Audit / decision logs
3 years
No
Securely deleted
Operational login logs
12 months
No
Securely deleted
Consents
Consent period + limitation period
No
Securely deleted
Company accounts
Contract + 2 years
No
Deleted on request
Backups
30 days rolling
No
Auto-purged
Why audit/decision logs are kept for 3 years. GDPR sets no fixed period; we justify retention against the limitation period for legal claims. Because AI-assisted hiring can give rise to discrimination or unfair-evaluation claims whose limitation periods exceed one year, we retain decision logs for 3 years for the establishment, exercise or defence of legal claims (GDPR Art. 17(3)(e)). Logs are minimised to identifiers and timestamps.
5. International data transfers
Our infrastructure is in the EU (Frankfurt, Germany). Sub-processors outside the EU/EEA use Standard Contractual Clauses (SCCs), and for Moldova the SCCs approved by the CNPDCP.
Sub-processor
Country
Purpose
Safeguard
Supabase
EU Frankfurt
Database, storage, auth
EU residency
OpenAI
USA
AI CV scoring (API only)
SCCs; no training on submitted content
Vercel
USA/EU
App hosting
EU region primary; SCCs
Resend
USA
Email delivery
SCCs; no CVs
Upstash Redis
EU West
Queue
EU region; transient
Sentry
USA/EU
Error monitoring
Anonymised; no CVs
The current list is at hrguru.work/subprocessors. We give advance notice of changes and clients may object on reasonable data-protection grounds (see the DPA).
6. Cookies
Category
Examples
Opt out?
Essential
Session, CSRF, auth tokens
No
Functional
NEXT_LOCALE, theme preference
Yes
Analytics (privacy-friendly)
Plausible Analytics
Yes
Marketing
None currently
N/A
We do not use Google Analytics, Facebook Pixel or behavioural advertising cookies. We honour the Global Privacy Control (GPC) signal.
7. Your rights
To exercise any right, email privacy@hrguru.work. We respond within one month (extendable to three for complex requests). First requests are free.
Right
EU/EEA
Moldova
Ukraine
California
Access / know
✓ Art. 15
✓
✓
✓
Rectification
✓ Art. 16
✓
✓
✓
Erasure
✓ Art. 17
✓
✓
✓
Portability
✓ Art. 20
✓
—
✓
Object to processing
✓ Art. 21
✓
✓
—
Object to automated decisions
✓ Art. 22
✓
✓
—
Restrict processing
✓ Art. 18
✓
✓
—
Withdraw consent
✓ Art. 7(3)
✓
✓
✓
For data subjects in the Republic of Moldova, from 23 August 2026 these rights are exercised under Law No. 195/2024; the supervisory authority is the National Center for Personal Data Protection (CNPDCP, datepersonale.md).
8. California residents — CCPA / CPRA
California residents have the rights to know, delete, correct, opt out of sale/sharing, limit use of sensitive personal information, and non-discrimination. HRGuru does not sell personal information and does not share it for cross-context behavioural advertising. Email privacy@hrguru.work with subject "CCPA Request"; we verify identity and respond within 45 days.
9. Supervisory authorities
EU/EEA: your national DPA (via EDPB) — edpb.europa.eu
Ukraine: Commissioner for Human Rights (Ombudsman) — ombudsman.gov.ua
California: California Privacy Protection Agency — cppa.ca.gov
10. Contact and updates
Controller: Viktor Razhev. Privacy contact: privacy@hrguru.work. DPO: Viktor Razhev.
We notify registered users of material changes by email and post updates at hrguru.work/privacy. Available in EN, RO, UK and RU; the English version prevails in case of conflict.
Legal review required: complete all [bracketed] fields and have qualified counsel (Moldova/EU/Ukraine) confirm the final text before publication.