Privacy Policy

1. Who we are

Syphtr ("we", "us") provides a recruiting platform that lets organisations upload, search, and manage candidate information — including CVs, LinkedIn exports, and job applications — alongside an optional shared database of candidate profiles. This policy explains what personal data we collect, why, and how it's handled.

2. Data we collect

From our customers (recruiters and their organisations): name, work email, organisation details, and billing information when you create an account or subscribe.

From candidates, via our customers: whatever a CV, LinkedIn export, or job application contains — typically name, contact details, work history, education, and skills. This data is uploaded and controlled by the organisation using Syphtr, not submitted by candidates directly to us in most cases, except where a candidate applies through a public application link. An organisation can also bring its candidates across from its own applicant tracking system by connecting it through Merge, in which case we read those candidates and their CVs from that system. For all of this data the organisation is the controller and we process it on its behalf, under our Data Processing Agreement.

From publicly available professional profiles: we maintain a searchable index of professional career information — names, job titles, employers, dates, and the descriptions people publish about their own work — compiled from publicly available and licensed sources. This is the database recruiters search when they are looking for people beyond their own records. We did not obtain this information from the people in it, and we say so plainly because you are entitled to know. We rely on legitimate interests (GDPR Article 6(1)(f)): connecting professionals with roles that match what they have publicly said they do is a purpose someone who publishes their career history would reasonably expect. For this index we are the data controller, which means requests about it come to us directly and are ours to action — see section 6. We do not sell this data, and we do not use it for advertising.

From third-party contact-lookup providers: for a candidate who doesn't already have a phone number or email on file, a recruiter using Syphtr can choose to look one up via Prospeo, a third-party contact-data provider, based on that candidate's publicly available LinkedIn profile. We only obtain and retain a phone number or email when that specific lookup succeeds — nothing is stored or charged for an unsuccessful attempt. We rely on legitimate interests (GDPR Article 6(1)(f)) as the lawful basis for this: genuine, individual recruiting outreach about a specific role, not bulk marketing or resale of contact data.

3. How we use it

• To provide the core service — storing, searching, matching, and scoring candidate data on behalf of our customers.
• To process CVs into structured data, using OpenAI's API to extract fields like name, work history, and skills from uploaded documents.
• To check the evidence behind a match — when a recruiter's search puts someone forward, or when a job application is scored — by asking OpenAI's API whether a candidate's own profile supports it. OpenAI does not use data sent through its API to train its models.
• To keep profiles in our searchable index current: when a recruiter's search or reveal reaches someone in it, we may fetch their current public LinkedIn profile via DataMagnet, and find its current address from their name and employer with a web search (Serper).
• To process payments and manage subscriptions, via Stripe.
• To send account, billing, and application-related emails, via Resend.
• To understand product usage and improve the service, via PostHog analytics (aggregated usage patterns, not candidate CV content).
• To authenticate users and manage organisation membership, via Clerk.

4. Who we share it with

We use a small number of sub-processors to run the service. We don't sell personal data, and we don't share it beyond what's needed to operate Syphtr:

• OpenAI — CV/résumé text extraction, and checking the evidence behind search matches and application scores.
• Merge — the connector an organisation can use to bring candidates and their CVs across from its own applicant tracking system (EU-hosted).
• DataMagnet — fetching a current public LinkedIn profile when a profile in our searchable index is revealed or refreshed.
• Serper — web search used to find the current address of a public professional profile.
• Prospeo — contact-detail lookup (email/mobile), used only when a recruiter specifically requests it for a candidate who doesn't already have one on file.
• Stripe — payment processing and billing.
• Clerk — authentication and account management.
• Resend — transactional email delivery.
• PostHog — product analytics.
• Cloudflare R2 — storage of uploaded files, including the original CV documents a recruiter uploads.
• Sentry — error monitoring and diagnostics, which can incidentally capture personal data present in an error report.
• Neon & Railway — database and application hosting.
• Upstash — the queue that carries background work (such as processing an upload) between parts of the service.
• Vercel — hosting for the web application.
• Google — only if a user connects their Google Calendar, to create interview events.

Where your data is held. Our main database is in London. Some of the providers above process data in the United States — including OpenAI, Stripe, Clerk, Resend, PostHog and Sentry. Where personal data leaves the UK we rely on the safeguards UK law provides for that transfer: the UK–US data bridge for certified US providers, or the ICO's International Data Transfer Addendum to the provider's standard contractual clauses.

5. Data retention

We retain candidate and account data for as long as an organisation maintains an active Syphtr subscription, plus a reasonable period afterward in case of reactivation or a legal retention requirement. An organisation's admin can remove individual candidates at any time (their details and career history are erased), and can delete the whole organisation — every candidate, CV, file and record in it — from the Organisation page. That deletion starts immediately, cancels the subscription, and removes everything tied to the organisation from the live service; copies in our backups expire within 30 days.

Profiles in our searchable index are kept while they remain useful for recruitment, and are updated or removed as their sources change. If you ask us to remove you, we delete your profile and career history, and keep only a one-way fingerprint — not your name, your contact details or your work history, and nothing that can be read back — so that we can recognise and reject your record if it ever reaches us again from another source. Keeping that much is the only way a removal stays permanent, and keeping less would mean quietly re-adding you later.

6. Your rights

Depending on where you're located, you may have the right to access, correct, or request deletion of personal data we hold about you, or to object to certain processing — including a phone number or email looked up via a third-party contact-lookup provider (see section 2). If you're a candidate and believe your information is held in Syphtr by an organisation you applied to, interacted with, or that looked up your contact details, contact us and we'll help direct your request to the right place — where the data was uploaded by an organisation using Syphtr, that organisation controls it and is best placed to act.

Our searchable index is different, and the responsibility is ours. We built it, so requests about it do not get passed to anyone else. Every email we send to someone in it carries a one-click removal link that needs no reply, no account and no explanation; using it deletes your profile immediately. You can also object to being included at all, or ask us what we hold, by emailing us at the address in section 9, and you do not have to give a reason.

We score profiles against what recruiters are looking for, which is what makes the index searchable. Those scores rank results; they never decide alone who is put forward for a role — a person makes that decision, and you have the right to ask us about it.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk. We would rather you told us first so we can put it right, but you are not required to.

7. Security

We use industry-standard measures to protect personal data, including encryption in transit, access controls, and restricting data access to what each part of the service actually needs. No system is perfectly secure, and we can't guarantee absolute security of information transmitted to us.

8. Changes to this policy

We may update this policy as the service evolves. We'll update the "last updated" date above when we do.

9. Contact

Questions about this policy or a data request can be sent to paul@syphtr.com.