Privacy policy
Version: 1.0 Effective date: 24 October 2026 Last updated: 24 October 2026
This Privacy Policy explains how we handle personal data at https://scoutfy.io. It covers our website and the Scoutfy applicant tracking service. Please read Section 2 first: it explains which parts of the data we control ourselves and which parts belong to the employers who use Scoutfy, because that determines who you should contact about your data.
1. Who we are
Scoutfy is operated by Katsiaryna Andryianava, an individual entrepreneur (empresaria individual / autónoma) established in Spain, tax identification number (NIE) Y7544167C, with a business address at Lugar do Pousadoiro 3, As Neves, 15613 A Capela, A Coruña, Spain (“Scoutfy”, “we”, “us”).
- Contact for privacy matters: legal@scoutfy.io
- Contact for support and security reports: support@scoutfy.io
We are a micro-enterprise and are not required to appoint a Data Protection Officer under Article 37 GDPR; privacy questions are handled by the business owner at the address above. Because we are established in Spain, no EU representative under Article 27 GDPR is required.
2. Two different roles: please read this first
Scoutfy is software that employers use to run their own recruitment. That means personal data flows through the platform in two different capacities.
We act as a data controller – we decide why and how the data is processed – for:
- visitors to our website https://scoutfy.io;
- the employers who buy the Service, their administrators and users of their accounts (registration, authentication, administration, billing, support and security);
- the email verification and the limited profile involved in giving a candidate access to the candidate portal (“Portal Access”);
- correspondence sent to us by email or through our contact forms;
- aggregated and anonymised statistics about how the Service is used.
We act as a data processor – we act only on the employer’s instructions – for everything a candidate submits to an employer through Scoutfy: the application, the CV, the cover letter, screening answers, the structured profile and AI assessment derived from them, and everything the employer’s recruiters add during the process (pipeline stages, comments, scorecards, interview bookings, offers, tags). For that data the employer is the controller, and our role is governed by the Data Processing Agreement at https://scoutfy.io/dpa.
What this means for candidates in practice. If you applied for a job through Scoutfy and you want to access, correct or delete your application, that request has to go to the employer you applied to, not to us. We cannot delete, change or hand over an application held in an employer’s account without that employer’s instruction, and we will not do so. If you do not know how to reach the employer, write to us at legal@scoutfy.io and we will point you in the right direction and let the employer know that you have been in touch. What we can act on directly is your access to the candidate portal and the data we keep to operate it, described in Section 3.4.
3. What personal data we process as controller, and why
3.1 Website visitors
What: IP address, browser and device information, pages visited, referring page, approximate location derived from the IP address, and information stored in or read from cookies and similar technologies (see Section 5).
Why: to serve the website, keep it secure and available, prevent abuse, and understand in aggregate how it is used.
Legal basis: our legitimate interest in operating and securing our website (Article 6(1)(f) GDPR); for any non-essential cookies, your consent (Article 6(1)(a) GDPR and Article 22.2 of Spanish Law 34/2002, LSSI).
3.2 Employer accounts and their users
What: first and last name, work email address, the role held in the account (administrator, recruiter, interviewer), company name, authentication events (magic-link requests, sign-ins, IP address and time), account settings, and the record of acceptance of our Terms of Use and Data Processing Agreement, including which version was accepted and when.
Why: to create and administer the account, authenticate users, provide support, secure the Service, detect and prevent abuse, and prove which version of our terms was accepted.
Legal basis: performance of the contract with the employer and steps taken at its request (Article 6(1)(b) GDPR); our legitimate interest in the security and integrity of the Service (Article 6(1)(f)); compliance with our legal obligations (Article 6(1)(c)).
3.3 Billing and payment
What: billing contact name and email, company name, billing address, VAT identification number, plan and subscription history, invoices, payment status. We do not receive or store full card numbers. Card details are entered directly with our payment processor, Stripe, which acts as an independent controller for that payment data under its own privacy policy.
Why: to take payment, issue invoices, keep accounting records and meet tax obligations.
Legal basis: performance of the contract (Article 6(1)(b) GDPR); compliance with legal obligations, in particular Spanish accounting and tax law (Article 6(1)(c)).
3.4 Candidate portal access
When a candidate wants to follow the status of an application, we send a magic link to the email address used in the application and keep a limited profile so that the portal knows which applications belong to that person.
What: email address, verification tokens and their expiry, sign-in events, and the link between that email address and the applications submitted with it.
Why: to verify that the person asking to see an application is the person who submitted it, and to prevent one candidate from seeing another candidate’s data.
Legal basis: our legitimate interest, and the interest of candidates and employers, in secure identity verification (Article 6(1)(f) GDPR).
Important: the portal shows the status of an application. It does not allow a candidate to delete or withdraw an application; those requests are for the employer to decide (Section 2).
3.5 Correspondence and support
What: your email address, the content of your message and any attachments, and our reply.
Why: to answer you, to keep a record of what was asked and answered, and to establish or defend legal claims where necessary.
Legal basis: performance of the contract for customers (Article 6(1)(b) GDPR); our legitimate interest in responding to enquiries and keeping records (Article 6(1)(f)).
3.6 Marketing communications
We do not send newsletters or other marketing email.
3.7 Aggregated and anonymised data
We produce statistics about the use of the Service – volumes, timings, funnel conversion, feature usage and model performance. This information is aggregated and anonymised so that it does not identify any candidate, user or customer, and it is not personal data once anonymised. We use it to operate, secure and improve the Service.
3.8 What we do not do
- We do not sell personal data, and we do not share it for advertising purposes.
- We do not build profiles of candidates for our own purposes, and we do not reuse one employer’s candidate data for another employer.
- We do not collect personal data about candidates from social networks, web searches, data brokers or background-check providers.
- We do not perform video or audio analysis, emotion recognition or biometric processing.
- As controller, we do not take any decision about you by automated means that produces legal effects or similarly significantly affects you.
4. Automated processing and AI
Scoutfy includes AI features that analyse the text of a CV and an application against a job description and return a category, a score and a written explanation. We run those features as a processor, on behalf of the employer, and we do so with a large language model provided by Anthropic PBC through its API. Under our contract with Anthropic, the text submitted to those features and the output generated from it are not used to train that provider’s generally available models.
The AI does not decide anything by itself: it categorises, scores and explains, and every decision about a candidate – including a decision not to proceed – requires a person at the employer to act. The employer is responsible for that human review and for the lawfulness of its selection criteria. A plain-language description of how the AI works is published at https://scoutfy.io/how-the-ai-works.
If you are a candidate and you want to know how a particular employer used the AI output in your case, or you wish to object to it, that question is for the employer as controller.
5. Cookies and similar technologies
We use cookies and similar technologies that are strictly necessary to operate the website and the Service – for example to keep you signed in, to remember your language and to protect against abuse. These do not require consent.
| Cookie / technology | Purpose | Provider | Lifetime |
|---|---|---|---|
session_id | Keeps employer users signed in | Scoutfy | Until sign-out |
_scoutfy_session | Blocks forged form submissions | Scoutfy | While the browser is open |
candidate_account_id | Keeps candidates signed in to application tracking | Scoutfy | 30 days |
cookie_notice_dismissed | Remembers you closed the cookie notice | Scoutfy | 1 year |
past_due_notice_dismissed | Remembers you closed the failed-payment notice | Scoutfy | 1 day |
locale | Remembers the language you picked | Scoutfy | 1 year |
You can delete or block cookies in your browser settings; if you block strictly necessary cookies, parts of the Service will not work.
6. Who we share personal data with
We use a small number of service providers. Each of them processes personal data only on our instructions or, where indicated, as an independent controller, and each is bound by a data processing agreement where it acts on our behalf.
| Provider | What it does | Where |
|---|---|---|
| Fly.io, Inc. | Application hosting and compute | EU hosting region (Amsterdam); company in the United States |
| Fly Managed Postgres | Database | Amsterdam, EU |
| Tigris Data | Storage of files uploaded to the Service | EU region (Amsterdam) |
| Anthropic PBC | AI analysis of application text, on behalf of employers | United States |
| Resend, Inc. | Delivery of transactional email | United States |
| GoDaddy | Transit of inbound email sent to our contact addresses | United States |
| Stripe | Payment processing and billing; independent controller for payment data | Ireland / United States |
We also disclose personal data where we are legally required to do so – for example to a court, a supervisory authority or law enforcement acting within its powers. Where the law allows, we tell the person concerned, and we challenge requests that appear unlawful or excessive.
If the business is reorganised, incorporated as a company or transferred to a successor, personal data may be transferred with it; the transferee assumes the same obligations, and we will announce such a change on this page.
7. International transfers
The application, the database and the files uploaded to the Service are hosted in the European Union. Some of the providers listed in Section 6 are established in the United States, so personal data reaches them there.
For those transfers we rely on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses, together with additional technical and contractual safeguards such as encryption in transit, access controls and limits on what the provider may do with the data.
You may request a copy of the safeguards in place by writing to legal@scoutfy.io.
8. How long we keep personal data
| Data | Retention |
|---|---|
| Employer account and user data | For the life of the account, and for thirty (30) days after the account is deleted, after which automatic clean-up runs; deletion of an account is preceded by a grace period of seven (7) days |
| Record of acceptance of our terms | Five (5) years after the end of the contract, matching the general limitation period for contractual claims in Spain |
| Billing and accounting records | The period required by Spanish tax and accounting law, currently up to six (6) years |
| Candidate portal access data | While the linked applications exist in the employer’s account; verification tokens expire within minutes of being issued |
| Support and other correspondence | Two (2) years from the last message |
| Security and authentication logs | Six (6) months |
| Website and cookie data | As stated in the cookie table in Section 5 |
| Backup copies | Deleted data may persist in backups until the end of the backup retention period of ten (10) days, after which it is removed in the ordinary rotation cycle |
Applications and other candidate data inside an employer’s account are kept for as long as that employer decides, within the retention settings it configures in the Service (6, 12 or 24 months after the end of a process, with 24 months as the default), after which the records are anonymised.
9. How we protect personal data
We apply technical and organisational measures appropriate to the risk, including: TLS encryption for all traffic; passwordless authentication with expiring magic links; separation of each customer’s data from every other customer’s; role-based access control; permission checks on every request for an uploaded file; scoped and revocable API tokens; signed webhooks; rate limiting; encrypted secret storage; automated security and dependency checks in our build pipeline; production access limited to the business owner; and an audit log of administrative actions. Backups are taken and retained as described in our documentation for customers.
We do not hold ISO 27001, SOC 2 or an equivalent certification, and we say so plainly rather than implying otherwise.
No system is perfectly secure. If a personal data breach occurs that is likely to result in a high risk to your rights, we will inform you in accordance with Article 34 GDPR; where the data belongs to an employer’s account, we inform that employer, who is responsible for notifying the people concerned.
10. Your rights
Where we act as controller, you have the right to: access your personal data; have it corrected; have it erased; restrict or object to processing, including processing based on our legitimate interests; receive your data in a portable format; and, where processing is based on consent, withdraw that consent at any time without affecting processing carried out before withdrawal.
To exercise these rights, write to legal@scoutfy.io. We answer within one month; if a request is complex we may extend that period by a further two months and will tell you why. We may ask for information to confirm your identity, and we will only ask for what is necessary for that purpose.
If you are a candidate and your request concerns an application held in an employer’s account, please see Section 2: that request has to be addressed to the employer.
If you believe we have handled your data incorrectly, we would like to hear from you first, but you always have the right to complain to a supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You may also complain to the supervisory authority of the EU country where you live or work.
11. Children
Scoutfy is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 14, the age at which a child can consent to information-society services under Spanish law. Where an employer’s recruitment involves applicants who are minors under local law, it is for that employer, as controller, to comply with the additional rules that apply.
12. Changes to this Policy
We may update this Policy – for example when we add features, change a service provider, or when the law changes. The version number and effective date at the top of this page always show the current version. Where a change materially affects how we handle personal data for which we are the controller, we will give notice by email to account administrators or through the Service before it takes effect. Previous versions are available on request.
13. Language
This Policy is published in English. Any translation is provided for convenience only, and in the event of any discrepancy the English version prevails.
14. How to contact us
- Privacy and data protection: legal@scoutfy.io
- Support and security: support@scoutfy.io
- Postal address: Lugar do Pousadoiro 3, As Neves, 15613 A Capela, A Coruña, Spain
Scoutfy – https://scoutfy.io – operated by Katsiaryna Andryianava, NIE Y7544167C, Spain.