Privacy Policy

1. Data Controller

The processing of personal data is carried out by Cruits (currently operated as a label under Charlie Works B.V., Netherlands). Cruits B.V. is intended to become the dedicated entity. For privacy questions, contact support@cruits.com.

2. Which Data We Collect

How we collect data. We collect personal data (i) directly from you when you create an account, complete your profile, upload documents, or use AI-powered features such as AI avatar interviews, AI CV parsing, or the AI assistant; (ii) automatically through your use of the app and website, including diagnostics, device identifiers, and usage events; and (iii) from employers, agencies, or verification providers you are matched with, where applicable.

We only process data that is needed to provide our services and improve service quality.

• Account data such as name, contact details, and login information.
• Application and profile data that users provide when using recruitment and matching features.
• Messages and support communication needed to operate the service.
• Technical and usage data such as diagnostics and performance events (for example through Sentry).
• The mobile app functions as an access point to the Cruits platform and does not collect additional personal data beyond what is required for platform functionality.

3. Why We Process Data

We process personal data on lawful grounds such as performance of a contract, legal obligations, legitimate interests, and consent where applicable.

• To create and manage user accounts and provide platform access.
• To support recruitment, matching, and identity verification workflows.
• To provide user support and handle questions, requests, and incidents.
• To secure our systems, prevent abuse, and comply with legal obligations.
• To monitor reliability and improve the product through analytics and diagnostics.

4. Sharing with Third Parties and Third-Party AI Processors

We share personal data only when necessary for the purposes above, always under a data processing agreement, and only with providers that offer a level of protection equivalent to that required by the GDPR. For each provider we list below what data is shared, for which purpose, and the provider's role. Cruits does not sell personal data, and Cruits does not permit its AI processors to use your personal data to train generative AI models.

• JobMojito (AI avatar interview provider — operated by FreshMint ai OÜ, Estonia). When you start an AI-assisted interview in Cruits, we send the following personal data to JobMojito: your name, the role you are applying for, your interview responses (audio, video, and transcribed text), and any profile details relevant to the interview. JobMojito acts as a processor, under a data processing agreement, and its privacy policy (section 2.3) confirms that it does not use identifiable candidate data to train AI models. JobMojito's primary processing is within the EU. The AI avatar interview is optional; we ask for your explicit consent in the app before any data is sent to JobMojito.
• OpenAI (AI CV parsing). When you upload a CV, we send the text of your CV to OpenAI's API to extract structured information such as work history, skills, education, and languages, so you do not have to fill in your profile manually. OpenAI acts as a processor under OpenAI's Data Processing Addendum and, per OpenAI's API terms, does not use your data to train its models. AI CV parsing is optional; you can fill in your profile manually. We ask for your explicit consent in the app before any CV text is sent to OpenAI.
• OpenAI (AI assistant). When you use the AI assistant inside Cruits, we send your messages and the minimum profile context needed for the assistant to answer (for example, the job you are viewing) to OpenAI's API. OpenAI acts as a processor under OpenAI's Data Processing Addendum and does not use your data to train its models. The AI assistant is optional; you can use Cruits without it, and you can turn it off at any time in Settings.
• VictoriaID (identity verification). When identity verification is required, we send your identity document and related personal data to VictoriaID for verification. VictoriaID acts as a processor.
• MySolution (back-office recruitment software). We share account and recruitment data with MySolution to operate staffing and payrolling workflows. MySolution acts as a processor.
• Sentry (technical error monitoring). We send diagnostic and crash data, which may include limited identifiers, to Sentry to detect and resolve technical issues. Sentry acts as a processor.

If we add a new processor or change how data is shared, we will update this policy and, where required, request renewed consent.

5. International Transfers

Our default approach is processing personal data within the European Union. Where a processor is based outside the EU/EEA, we apply the safeguards required by EU data protection law, in particular the Standard Contractual Clauses. In particular:

• JobMojito primarily processes personal data within the EU.
• OpenAI processes data in the United States. Transfers to OpenAI are covered by OpenAI's Data Processing Addendum, which incorporates the EU Standard Contractual Clauses, and by appropriate technical and organisational safeguards.
• Other processors that may operate outside the EU/EEA are bound by Standard Contractual Clauses and equivalent safeguards.

6. Cookies and Similar Technologies

On our website and platform, we use different categories of cookies and similar technologies:

• Essential cookies and storage, required for core functionality and security.
• Analytics technologies to understand usage and improve product performance.

7. Retention Periods

We do not retain personal data longer than necessary and always in line with applicable law. Current principles include:

• If employment ends, personal data is removed no later than two years after the last working day.
• Administrative documents are retained for 7 years (for example payroll administration, temporary employment agreement, and pension obligations where applicable).
• Data required for identification or tax obligations, such as name and address details, BSN, date of birth, and payroll tax data, is retained for at least 5 years from the end of the calendar year in which employment ended.
• For complaints or claims, we retain only necessary data until the matter is definitively resolved.

8. Your Rights

Where applicable, you can request access, correction, deletion, restriction of processing, objection to processing, and data portability. You can also withdraw consent where processing is based on consent.

Requests can be sent to support@cruits.com. We aim to respond within 30 days.

9. Children

Our services are not intended for children or minors.

10. Contact

For privacy questions, rights requests, or complaints about data handling, contact:

11. Changes to This Policy

We may update this Privacy Policy when our services or legal requirements change. The latest version will always be available on this page.