Privacy notice

Holders: your sign-in identifier, the CV you upload (deleted once it is read), your profile and its visibility settings, your criteria, your notification address if you add one, the opportunities and requests you receive and your decisions, support messages, terms acceptances, and counts of visits to your profile.

Recruiters: your email address and domain, your organization and role, the opportunities and questions you send, the information holders chose to share with you, developer clients, webhooks and templates, billing records of your company, support messages and terms acceptances.

Everyone: technical data needed to run and protect the service, such as request identifiers, a keyed (non-reversible) form of IP addresses for rate limits, and security logs. We do not use advertising trackers or third-party analytics.

To provide AgensID as you set it up: your profile, your agent, opportunities, introductions, notifications and support (performance of a contract).

To keep AgensID secure and fair: rate limits, bot checks, abuse reports, moderation, audit records and fraud prevention (legitimate interests).

To bill hiring companies and keep accounting records (contract and legal obligation).

AI model processing happens only if you choose it, for the tasks you choose (contract, at your choice). The waiting list is based on your consent, which you can withdraw at any time.

Items you mark Public, and your address, name and summary once you publish, are visible to anyone and any software. Ask-first items are shared only with a recruiter whose specific request you approve. Private items are never shared. Your profile is signed with your key so others can check it came from you; the signature does not make it public by itself.

Recruiters receive only what is public and what you approve. Our processors, under contract and only for the purposes above: Hetzner Online GmbH (hosting and database, EU), Cloudflare, Inc. (network, TLS and bot checks), Resend (email delivery), WorkOS, Inc. (holder sign-in), Polar Software, Inc. (reseller and merchant of record for companies' paid plans: payment, taxes and invoices) and, only if you choose the platform model, Anthropic PBC (language model). Some are outside the EU or Turkey; transfers rely on [adequacy decisions / standard contractual clauses / explicit consent where required by KVKK].

We do not sell personal data.

Account data until you delete your account; uploaded CV files only until they are read; sign-in links for minutes and sessions for days; delivery and notification records for 30 to 90 days; support requests up to two years; audit records two years without values; billing records as long as accounting law requires; the waiting list until you are invited, at most one year. Details are in our retention schedule.

When you delete your account, your data key is destroyed, so remaining encrypted copies, including in backups, can no longer be read; deletions are re-applied if a backup is ever restored.

Sensitive values are encrypted with a key per account; access is limited by database row security; staff see queues without personal content and every staff read is logged; we test for vulnerabilities continuously and publish a security contact.

You can access and download your data (export), correct it, delete your account, withdraw what you shared, object to processing based on legitimate interests, and withdraw consent. Most of this works in the app; otherwise write to [email protected]. We answer within one month.

You may complain to a supervisory authority, in Turkey the Personal Data Protection Authority (KVKK) and in the EU the authority of your country.

If we change this notice materially, we tell you before it applies and ask you to acknowledge the new version.