Applicant Privacy Policy

Notice at Collection and Privacy Policy for Job Applicants Who Reside in UK/EU and Additional rights for USA (New York)

Effective Date: July 28, 2026

Introduction

As a technology company committed to fairness, transparency, and legal compliance, Recraft Inc. and Recraft AI Limited conducts all recruitment activities in a manner that respects applicants’ privacy and upholds equal opportunity principles.

This Recruitment and Applicant Privacy Policy explains how we collect, use, disclose, and protect personal information obtained during the hiring process and the rights available to you under applicable laws. This policy applies to all recruitment and selection activities for roles within Recraft and its subsidiaries, including full-time, part-time, fixed-term, contractor, and internship positions. It covers all departments and job functions - engineering, marketing, operations, analytics, and others.

All individuals involved in hiring (including hiring managers, HR personnel, and any third-party recruiters acting on our behalf) must comply with this Policy and related procedures.

Where we process personal information, we do so in accordance with the UK Data Protection Act 2018 and UK GDPR, the EU General Data Protection Regulation (EU GDPR), relevant U.S. federal and state privacy and employment laws, including the New York SHIELD Act and California Privacy Rights Act (CPRA), and any other data protection or employment laws that apply to our operations.

If you have any questions about this Policy or how your personal information is handled, you can contact us at help@recraft.ai.

1. THE CATEGORIES OF PERSONAL INFORMATION WE COLLECT ABOUT YOU

We collect and process personal information about you during the recruitment process to evaluate your suitability for employment and to meet our legal and business obligations. The types of personal information we handle fall into the categories below:

1.1 Information we collect directly from you (required for the recruitment process)

This information is needed for us to consider your application and communicate with you: (i) Identifiers: Full name, preferred name, contact details (email address, phone number, postal address) and signature; (ii) Employment and Education History: Employment history, academic qualifications, certifications, training records, and professional memberships or licenses; (iii) Right-to-Work and Identity Verification: Copies of passports, visas, or other documentation required to confirm eligibility to work in the relevant jurisdiction; (iv) Interview and Assessment Data: Responses to screening questions, test results, and notes or evaluations made by our interviewers or hiring team; audio recordings and transcripts of interviews conducted using AI notetaking tools; AI-generated summaries and suggested feedback produced from those recordings; and data generated through AI-assisted review of your application materials. Voice data captured during recorded interviews is used only for transcription purposes; and (v) Other Information You Choose to Provide: Details in a CV or cover letter such as hobbies, volunteering experience, or links to public profiles (e.g. LinkedIn, personal websites).

1.2 Information you may choose to provide or that we may collect in limited circumstances

This information includes: (i) Diversity and Equal Opportunity Information: Data relating to protected characteristics (e.g. race, ethnicity, gender, disability status, veteran status, or age) used solely for equal opportunity monitoring and to meet reporting obligations under applicable laws; (ii) Health Information: limited information about a disability or medical condition, only where necessary to arrange reasonable accommodations during the recruitment process or to comply with occupational health and safety requirements; (iii) Financial or Expense Information: details needed to process travel or interview expense reimbursements; and (iv) Publicly Available Information: Information from professional networking or public records that relate to your qualifications or experience.

1.3 Information collected automatically (technical and security monitoring)

When you use our online recruitment page or systems or visit our facilities, we may automatically collect limited data such as: (i) Technical Information: Log data, IP addresses, browser type, and usage statistics on our career website or application portal to maintain system security and integrity; and (ii) Security and Access Monitoring: CCTV footage or visitor entry logs when you attend a Company office, used solely for the protection of employees, visitors and Company property.

1.4 Sensitive or Special Category Information

Where we collect special category data (such as diversity or health information) we process it only: (i) with your explicit consent, or (ii) where required or permitted by law (e.g. to comply with the UK Equality Act 2010, EU Employment Equality Directive, the Americans with Disabilities Act, or similar laws).

1.5 Note on Inferring Characteristics

The Company does not collect, use, or process sensitive personal information or characteristics of protected classifications (such as race, ethnicity, religion, sexual orientation, disability, health status, or other protected attributes) for the purpose of inferring characteristics about applicants.

Any special category or sensitive information that may be collected (e.g. for equal opportunity monitoring or to arrange accommodations) will be processed only for those lawful and limited purposes, in compliance with applicable data protection and anti-discrimination laws (including GDPR/UK GDPR, New York State Human Rights Law, and California CPRA).

Recruitment decisions are based solely on professional skills, qualifications, and relevant experience.

2. THE CATEGORIES OF SOURCES FROM WHICH WE COLLECT YOUR PERSONAL INFORMATION

We obtain personal information from the following sources, depending on the stage of the recruitment process: (i) You, directly, through your application materials, communications, and participation in interviews or assessments; (ii) Third-Party Service Providers, including recruitment agencies, background check or assessment vendors, and technology providers who host or support our application systems, all acting under written agreement; (iii) Professional References from former employers and nominated references; (iv) Publicly Available Sources, such as professional networking sites (e.g. LinkedIn), industry directories, or public records relevant to verifying credentials; (v) Automated or Technical Systems, limited data (such as device identifiers, login activity, or visit records) collected automatically when you use our careers website or recruitment platform, for system administration, security and fraud prevention; (vi) Security and Access Monitoring, CCTV or entry-log data when you attend a Company site, used solely to maintain safety and facility security; (vii) Affiliated or Acquired Companies, where your information is lawfully transferred to us as part of a corporate transaction or group hiring process; and (viii) Government or Regulatory Authorities, only when disclosure is legally required (for example, to confirm right-to-work or perform background checks permitted by law).

3. THE PURPOSES FOR WHICH WE USE YOUR PERSONAL INFORMATION

We use personal information about applicants only for lawful, specific, and limited purposes in connection with recruitment and hiring. The main purposes and their lawful bases are summarized below.

3.1 Recruitment and Selection

We process your personal information to: (i) assess your skills, qualifications, and suitability for employment; (ii) communicate with you about your application and next steps; (iii) arrange and conduct interviews, assessments, and reference checks; (iv) verify your identity, right to work, and credentials; (v) issue and manage offers of employment and pre-employment documentation; (vi) create a talent pool for future roles (with your consent, where required); (vii) use AI-powered tools to assist in reviewing applications and evaluating candidates, including generating transcripts, summaries, and suggested feedback from recorded interviews. All AI-assisted outputs are subject to human review before any recruitment decision is made, and your data is not used to train AI models; and (viii) for certain roles, applications may be reviewed with the assistance of an internal AI tool that generates a summary and score based on your CV and our hiring criteria. This output is only one input into our hiring team’s review, as all hiring decisions are made by a person.

Why we use it (legal basis): To take steps at your request prior to entering into an employment contract and to pursue our legitimate business interest in running an effective, fair recruitment process. Where interviews are recorded, we will rely on your consent as the lawful basis for that processing (UK/EU applicants) or our legitimate interests (where consent is not required under applicable law). You will be informed of any recording at the time of scheduling or at the start of the interview and may request a non-recorded process.

3.2 Diversity, Equity, and Inclusion (DEI) Monitoring

We may use information you voluntarily provide about protected characteristics - such as gender, ethnicity, disability, or veteran status - to: (i) meet equal-opportunity and diversity reporting obligations required by law; and (ii) assess and improve the inclusiveness of our hiring practices.

Why we use it (legal basis): To comply with employment and equality laws and to promote a diverse and inclusive workplace. Providing this information is entirely voluntary and does not affect your candidacy.

3.3 Accommodations and Health & Safety

We may process limited health information to: (i) arrange reasonable accommodations during interviews or assessments; and (ii) meet occupational health and safety requirements.

In rare circumstances, we may use emergency contact information to respond to an on-site medical or safety incident during the recruitment process.

Why we use it (legal basis): To comply with legal obligations and to ensure accessibility and safety for all applicants. We do not conduct pre-employment medical examinations or collect health information beyond what is necessary for these purposes.

3.4 Security, Monitoring, and Compliance

Certain information may be used to: (i) manage secure access to our offices, systems, and online platforms; (ii) prevent fraud or unauthorized activity; (iii) conduct internal audits or investigations; and (iv) comply with applicable laws, court orders, or regulatory requirements.

Why we use it (legal basis): To meet legal and regulatory obligations and to protect our applicants, employees, and Company assets.

3.5 Business Operations and Administration

We use information for limited operational purposes, including to: (i) plan and manage recruitment budgets and travel reimbursements; (ii) evaluate and improve our recruitment processes; (iii) maintain records for compliance and governance; and (iv) support potential corporate transactions (such as mergers or acquisitions) when relevant.

We may also use anonymized recruitment data for internal training, quality assurance, and process improvement purposes.

Why we use it (legal basis): To pursue our legitimate interest in managing efficient and compliant business operations.

3.6 Legal Rights and Obligations

We may process or disclose personal information to: (i) establish, exercise, or defend legal claims; (ii) respond to lawful requests from authorities; and (iii) comply with employment, tax, audit, or other statutory duties.

Why we use it (legal basis): To fulfill legal obligations and protect our rights and interests.

3.7 With Your Consent (Where Applicable)

In limited circumstances, we may process your personal information with your consent - for example: (i) retaining your details to be considered for future vacancies; or (ii) featuring testimonials or participation in recruitment marketing materials.

You may withdraw consent at any time by contacting help@recraft.ai, and this will not affect your ongoing application.

3.8 All processing of applicant information is carried out in accordance with applicable data-protection laws, including the UK Data Protection Act 2018, the UK GDPR, the EU GDPR, and relevant U.S. federal and state privacy regulations (e.g. the New York SHIELD Act and CPRA).

4. HOW WE MAY DISCLOSE YOUR PERSONAL INFORMATION

We treat applicant information as confidential and only share it when necessary for the purposes described in this Policy or as required by law. Whenever we disclose personal information, we do so under appropriate confidentiality, data-protection, and security safeguards.

4.1 Service Providers and Business Partners

We share personal information with trusted third parties that help us conduct recruitment and related business functions, such as: (i) recruitment agencies and external recruiters; (ii) background-check and assessment providers; (iii) law firms, travel or relocation agencies, and other professional advisers assisting in the hiring process; and (iv) technology and platform providers supporting our careers website or applicant tracking system, including our applicant tracking system provider Ashby, which includes AI-assisted application review and AI Notetaker, through which applicant data (including application materials and interview recordings) may be transmitted to the following AI providers engaged by Ashby: OpenAI, Amazon Web Services (AWS Bedrock), and Google Gemini. Data transmitted to these providers is used solely to enable AI features, is limited to the minimum necessary for each request, is not retained beyond the processing session, and is not used to train AI models.

These parties process information on our behalf and are bound by written contracts that require them to: (i) process data only for authorized purposes; (ii) apply appropriate technical and organizational security measures; and (iii) comply with applicable data-protection laws.

4.2 Public Authorities and Legal Obligations

We may disclose personal information when required or permitted by law, such as: (i) to verify right-to-work or professional credentials; (ii) in response to lawful requests from government or regulatory bodies; (iii) to comply with a subpoena, court order, or other legal process; or (iv) to protect our legal rights or the safety of applicants, employees, or others.

4.3 Security and Access Monitoring

If you visit our offices or attend an in-person interview, we may share limited security or access data (for example, visitor registration logs or CCTV footage) with authorized facilities, safety, or security personnel, but only to the extent necessary to maintain site safety and compliance with our security obligations.

4.4 No Sale or Cross-Context Behavioral Sharing

We do not sell applicant personal information or share it for cross-context behavioral advertising or any form of marketing unrelated to recruitment.

4.5 International Data Transfers

Where applicant information is transferred to or accessed from countries outside the United Kingdom or the European Economic Area, we ensure that appropriate safeguards are in place - such as the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum - to protect your information in accordance with applicable data-protection laws. This includes transfers to our applicant tracking system provider and its AI-subprocessors, all of which are based in the United States. Transfers to each of these providers are subject to Standard Contractual Clauses or equivalent transfer mechanisms.

4.6 Data Security and Retention of Shared Information

All disclosures are limited to the minimum information necessary for the intended purpose.

We require our service providers and partners to retain personal information only as long as needed to fulfill the recruitment-related purpose or to meet legal requirements, after which it must be securely deleted or anonymized.

5. HOW LONG WE KEEP YOUR PERSONAL INFORMATION

We retain applicant personal information only for as long as necessary to fulfil the purposes described in this Policy, or as required by law. Retention periods vary depending on whether you are hired and where you are based.

5.1 If You Are Hired

If you become an employee, the information collected during the recruitment and onboarding process becomes part of your personnel file. We retain it for the duration of your employment and thereafter only as long as required to meet legal, tax, payroll, or recordkeeping obligations. Employees can review our internal Data Retention policy on request.

5.2 If You Are Not Hired

If you are not offered or do not accept a position:

5.2.1 United Kingdom and European Union: We normally retain your personal information for up to 12 months after the recruitment process concludes. This allows us to demonstrate compliance with equal opportunity and recruitment laws, and - if you consent - to consider you for future suitable roles. After this period, your information will be securely deleted or anonymized unless longer retention is required by law or you have renewed consent for ongoing consideration.

5.2.2 United States: We retain applicant data for up to three (3) years after collection. This reflects federal and state recordkeeping requirements (for example, EEOC, Title VII, and New York State Human Rights Law) and enables us to manage compliance and potential legal claims. Where feasible, data is securely deleted or anonymized once no longer needed.

5.3 Other Retention Circumstances

We may retain limited information longer than the periods above if: (i) required to comply with a legal obligation or respond to a claim; (ii) necessary to protect our rights or those of others; or (iii) you have given consent for us to hold your data for future opportunities.

When retention is no longer necessary, information will be securely deleted, pseudonymized, or anonymized in line with our data-protection standards.

5.4 Data-Storage Security

We store applicant information on secure systems with access limited to authorized personnel involved in recruitment or compliance. We apply technical and organizational measures - such as encryption, access controls, and regular deletion schedules - to protect your personal information throughout its lifecycle.

5.5 All retention and deletion practices comply with applicable data-protection and employment laws, including the UK Data Protection Act 2018, UK GDPR, EU GDPR, and relevant U.S. federal and state requirements.

6. YOUR PRIVACY RIGHTS AND HOW TO EXERCISE THEM

Depending on where you live, you may have certain legal rights regarding your personal information.

6.1 UK and EU (GDPR / UK GDPR)

If you are based in the United Kingdom or the European Union, you have the following rights under data protection law: (i) Right of access – to request a copy of the personal information we hold about you; (ii) Right to rectification – to correct inaccurate or incomplete information; (iii) Right to erasure (“right to be forgotten”) – to request that we delete your personal information in certain circumstances; (iv) Right to restrict processing – to ask us to limit the way we use your data; (v) Right to object – to object to processing of your data where we rely on legitimate interests; (vi) Right to data portability – to receive your personal information in a structured, commonly used, and machine-readable format and transfer it to another organization, where technically feasible; and (vii) Right to withdraw consent – where we process your information based on your consent (e.g., to retain your CV for future opportunities), you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

You also have the right to lodge a complaint with your local supervisory authority if you believe your information has been processed unlawfully (for example, the Information Commissioner’s Office in the UK).

6.2 United States

If you are based in the United States you have rights under state and federal laws relating to privacy and equal opportunity. These include: (i) Right to know – to be informed about what categories of personal information we collect, why we collect it, and how it is used and shared; (ii) Right to correct – to request correction of inaccurate personal information; (iii) Right to delete – to request that we delete your personal information, subject to legal and business requirements; (iv) Right to equal treatment – you will not be discriminated or retaliated against for exercising your privacy or employment rights (as protected by New York Human Rights Law and federal anti-discrimination laws); and (v) Right to data security – under the New York SHIELD Act, we must implement safeguards to protect your personal data from unauthorized access or disclosure.

6.3 How to Exercise Your Rights

You may exercise your rights by contacting us at: help@recraft.ai.

We may need to verify your identity before responding to a request. We will respond within the timeframes required by law (for example, one month under GDPR, 45 days under some U.S. laws). Where a request is complex or numerous, these periods may be extended as permitted by law, and we will notify you if that occurs.

7. Company’s Non-Discrimination and Non-Retaliation Policy

The Company will not unlawfully discriminate against you or retaliate against you for exercising your privacy or employment rights under applicable laws, including:

7.1 UK and EU: rights under the UK GDPR, EU GDPR, and the Equality Act 2010 / EU Employment Equality Directive.

7.2 United States (including New York): rights under federal law and state laws such as the New York State Human Rights Law and the SHIELD Act.

7.3 This means that if you make a request to access, correct, or delete your personal information, or if you raise a concern, file a complaint, or participate in an investigation, you will not be treated unfavorably or disadvantaged in the recruitment process as a result.

8. Policy Review & Changes

This Recruitment Policy will be reviewed annually to ensure compliance with changes in law (e.g. GDPR updates, UK employment law, U.S./New York regulations) and internal best practice.

9. Contact Us

For any questions about the Company’s recruitment or privacy practices, please contact help@recraft.ai.