The short version
- We collect only what Rycuta needs to work: account details, what your team puts in its workspace, and what candidates send through your apply pages.
- For candidate data, the employer decides how it is used. We process it on the employer's behalf, under a written agreement with them.
- AI proposes criteria and assesses CVs against them. Rycuta never advances or rejects anyone on its own; people decide.
- We don't sell personal data, and our AI provider may not train its models on the data we send it.
- Ask us at info@rycuta.com for a copy of your data, or to correct or delete it.
01Who we are
Rycuta is operated by AXONFOLD LLC, Mamikoniants 62, Yerevan, Armenia ("AxonFold", "we", "us"). You can reach us about anything in this policy at info@rycuta.com.
02Our two roles
The organisation that decides why and how personal data is used is its controller; one that processes it on that organisation's behalf is a processor. We are:
- the controller for data about visitors to rycuta.com, people who contact us or request early access, and people who hold Rycuta accounts;
- a processor for candidate data in a customer's workspace. The employer decides how that data is used and is its controller.
Before an employer uses Rycuta with real candidate data, we sign a data processing agreement with them. Employers are responsible for telling candidates how their data is used, including that AI assists the assessment and that people make the decisions.
Applied for a job through Rycuta? The employer you applied to is responsible for your data, and their privacy notice applies. Contact them first; if you can't reach them, write to us and we will help.
03What we collect
| Category | What | From |
|---|---|---|
| Account | Email address, password (stored hashed by our sign-in provider), name and an optional profile photo. | You |
| Workspace content | Job postings, criteria, notes, stage changes, rejection reasons, and the record of who did what and when. | You and your team |
| Candidate data | Name, email, phone, LinkedIn profile, current job title, CV file, cover letter, AI assessments and hiring stage. | Candidates, through apply pages; recruiters who upload CVs |
| Apply-page protection | IP address, to limit repeated submissions, and a bot-check token. | Automatically, on apply pages |
| Requests to us | Email, name, company and your message. | You |
We don't use analytics or advertising trackers.
04How we use it, and why
| Purpose (we are the controller) | Legal basis (GDPR Article 6) |
|---|---|
| Run your account and workspace, including the AI features you use | Our contract with you |
| Answer messages and early-access requests | Steps you ask us to take before a contract, or our legitimate interest in replying |
| Keep Rycuta secure, including rate limits and the bot check | Our legitimate interest in a safe, reliable service |
| Send service emails, such as workspace invitations | Our contract with account holders, or a legitimate interest in delivering an invitation |
| Meet legal obligations | Legal obligation |
For candidate data, we act only on the employer's instructions and only to provide the service they use. We don't sell personal data or use it for advertising.
05AI
Rycuta's AI proposes criteria from a job description, assesses each CV against every criterion with its reasoning, reads contact details from CVs, and drafts job descriptions when asked. People review the results.
Rycuta never advances or rejects anyone on its own. Moving a candidate forward, shortlisting and rejecting are actions a person takes, and they are recorded. AI assessments can be wrong; candidates can ask the employer for a person to review their application.
To produce these results, the text of job descriptions, criteria and CVs is sent to Groq, our AI provider. Its services agreement doesn't allow it to use that data to train or fine-tune models, and we have turned on its zero data retention setting.
07How long we keep it
Rycuta doesn't yet delete data automatically on a schedule. Today:
- Workspaces are kept until their owner deletes them, which deletes their postings, applications, candidates, members and activity record. We then remove the workspace's CV files from storage within one month.
- Candidate data is kept for as long as the employer keeps it. Employers can ask us to delete specific candidates, including their CV files.
- Accounts, messages, early-access requests and apply-page IP addresses are kept until you ask us to delete them.
- Backups: deleted data can remain in our database provider's backups until those backups expire.
To delete data, write to info@rycuta.com. We complete deletion requests within one month.
08Your rights
Depending on where you live, you can ask us for a copy of your data, or to correct, delete, restrict or move it, and you can object to how we use it. We reply within one month.
If you are a candidate, the employer you applied to handles these requests, including a person reviewing your application; we will help them. You can also complain to a data protection authority: in Armenia, the Personal Data Protection Agency of the Ministry of Justice; in the EU, the authority where you live or work.
10Security
Data is encrypted in transit and CVs are stored privately. Each workspace's data is kept apart at the database level, access follows five roles, and actions are recorded. Apply pages are protected by a bot check, a spam trap and rate limits. If you find a vulnerability, tell us at info@rycuta.com.
Rycuta is for employers and is not meant for anyone under 16.
11Changes
We will post changes here and update the date above. If a change is significant, we will email account holders before it takes effect.