---
title: Privacy policy | Echo Recruit
description: "How Echo Recruit handles personal data: what this site collects, what lives in a customer workspace, résumé storage and deletion, subprocessors and your rights."
---

[Echo Recruit](https://www.echorecruit.com/?hsLang=en)

[Product](https://www.echorecruit.com/product?hsLang=en)[Resources](https://www.echorecruit.com/resources?hsLang=en)[What it costs](https://www.echorecruit.com/#pricing)[Contact](https://www.echorecruit.com/contact-us?hsLang=en)

[Schedule a demo](https://www.echorecruit.com/contact-us#form)

# Privacy policy

Two kinds of personal data pass through Echo Recruit, and they are governed differently: the little we collect about you on this website, and the candidate and employee records our customers keep in their own workspaces. This policy covers both, and says which is which.

Last updated 18 September 2026

## 1. Who we are

Echo Recruit (“we”) provides recruitment operations software to HR teams. Our registered address is **\[TO BE COMPLETED: registered address\]**. For anything in this policy, write to [privacy@echorecruit.com](mailto:privacy@echorecruit.com).

## 2. Our two roles

**We are the controller** for data about visitors to this website and about the people who administer a customer account — the enquiry you send us, your sign-in email, your workspace’s settings.

**We are a processor** for everything a customer puts into their workspace: candidate profiles and résumés, their clients’ contact details, and the employment records of the people they place. Our customer is the controller of that data. They decide what to collect, how long to keep it and who to share it with; we hold it on their instruction and do not use it for our own purposes. If you applied for a job through an Echo Recruit application link or careers page, your data belongs to the organisation that advertised the role, and your requests are best sent to them — though we will help them answer you, and section 9 explains how.

## 3. What this website collects

Very little, and none of it for advertising.

- **The contact form.** Your name, email address, and whatever you write in the message box, used to reply to you and to keep a record of the conversation. We do not sell or share it.
- **Server logs.** Our host records request metadata, including IP address, for security and to keep the site running.
- **Cookies.** This site runs on HubSpot, which sets cookies for analytics and for remembering a form submission. You can decline non-essential cookies through the banner where one is shown.

## 4. What lives inside a workspace

When a customer uses Echo Recruit, their workspace can contain: client companies and contacts; candidate names, contact details, work history and résumé files; application and interview records including scorecards and evaluation scores; and, for people they place, employment records — assignments, pay rates, leave balances, timesheets, performance reviews, onboarding documents and exit records.

Every one of those tables is scoped to a single workspace by row-level security in the database, so one customer cannot read another’s rows. Commercial figures — revenue, contract margin, billing — are further restricted to workspace administrators by the database itself, not merely hidden in the interface.

## 5. Résumés and documents

- Files are held in **private storage**. Nothing is served from a public URL.
- A download is authorised per request: we check that the caller belongs to the workspace that owns the record, then mint a signed link that **expires after five minutes**. A link that leaks stops working.
- Uploads never come from a candidate’s browser directly into storage — the intake route writes the file, so every stored file has a record behind it.
- **Retention defaults to two years**, after which a scheduled sweep deletes the file and then clears the pointer to it. Each customer can shorten or lengthen that window for their own workspace.

## 6. Automated processing and AI

Applications are scored deterministically — a weighted comparison of skills, years of experience and role match against the requisition’s own brief. Where a customer enables it, three further features send data to Anthropic’s API: reading a résumé into structured fields, drafting shortlisting criteria for a role, and ranking a shortlist with written reasoning.

What is sent is the résumé or profile and the job’s requirements — not a customer’s whole database. Evaluations are written **append-only** against the version of the rubric that produced them, so a scoring decision can be reconstructed as it was made rather than as the rules read today. Scores rank and explain; they do not auto-reject.

## 7. Subprocessors

We use the following processors to run the service. The last four are engaged only when a customer chooses to connect that account.

| Processor | What it does |
| --- | --- |
| Supabase | Database, authentication and file storage for your workspace. |
| Vercel | Application hosting and content delivery. |
| HubSpot | This website, and the enquiries submitted through it. |
| Anthropic | Résumé parsing, criteria drafting and candidate ranking, when those features are used. |
| Google | Only if you connect a Google account: Gmail sync, calendar invites and Meet links. |
| Microsoft | Only if you connect a Microsoft account: sign-in and Teams meeting links. |
| Zoom | Only if you connect a Zoom account: meeting links for interviews. |

When a customer connects a mailbox or meeting account, the refresh token for it is **encrypted at rest** with a key held outside the database. Team invitations are stored only as a SHA-256 hash of the invitation token, so a leaked database does not hand over working invitations.

## 8. International transfers

Our processors operate infrastructure in several countries, so data may be processed outside the country it was collected in. Transfers rely on the mechanisms in each processor’s own data processing terms. **\[TO BE COMPLETED: governing law and jurisdiction\]** governs this policy.

## 9. Your rights

Depending on where you live, you may have the right to access a copy of your personal data, correct it, delete it, restrict or object to its processing, or receive it in a portable form.

- **If you contacted us through this website**, or you administer a customer account, write to [privacy@echorecruit.com](mailto:privacy@echorecruit.com) and we will act on it directly.
- **If you are a candidate or a placed employee**, the organisation holding your record is the controller. Ask them. If you cannot reach them, tell us who they are and we will pass the request on and support them in answering it — but we will not delete or disclose their records on our own initiative.
- Customers can raise a data-rights request against an employment record inside the product, which records the request and its outcome rather than leaving it in somebody’s inbox.

## 10. How long we keep things

| Data | Kept for |
| --- | --- |
| Enquiries from the contact form | Up to 24 months from the last exchange, then deleted — unless you have become a customer, in which case it forms part of the account record |
| Résumé files in a workspace | The customer’s retention window, two years by default |
| Workspace records | For the life of the subscription, with an export window on termination |
| Audit log entries | For the life of the workspace. They are append-only by design: a log an administrator can edit is not a log |
| Server logs | As retained by our hosting provider for security and reliability |

## 11. Security

Data is encrypted in transit. Access inside the product is enforced by the database rather than by application code that a future query could forget: row-level security scopes every table to a workspace, commercial figures are admin-only, and an audit log of changes to money and permissions is written by database trigger so no code path can skip it. Interview scorecards are hidden from the rest of the panel until submitted. No system is immune, and we will tell affected customers without undue delay if we discover a breach that affects them.

## 12. Children

The service is sold to businesses and is not directed at children. We do not knowingly collect data from anyone under 16 through this website.

## 13. Changes to this policy

We will update the date at the top when this changes, and will tell customers directly about a change that materially affects how their workspace data is handled — a new subprocessor, or a new purpose. We will not quietly repurpose data that was collected for something else.

## 14. Contact

[privacy@echorecruit.com](mailto:privacy@echorecruit.com). If you are in the UK or EU and believe we have not resolved your concern, you may complain to your local supervisory authority.

## On this page

- [Who we are](https://www.echorecruit.com/privacy#who-we-are)
- [Our two roles](https://www.echorecruit.com/privacy#two-roles)
- [What this website collects](https://www.echorecruit.com/privacy#website)
- [What lives in a workspace](https://www.echorecruit.com/privacy#workspace)
- [Résumés and documents](https://www.echorecruit.com/privacy#resumes)
- [Automated processing and AI](https://www.echorecruit.com/privacy#ai)
- [Subprocessors](https://www.echorecruit.com/privacy#subprocessors)
- [International transfers](https://www.echorecruit.com/privacy#transfers)
- [Your rights](https://www.echorecruit.com/privacy#rights)
- [How long we keep things](https://www.echorecruit.com/privacy#retention)
- [Security](https://www.echorecruit.com/privacy#security)
- [Contact](https://www.echorecruit.com/privacy#contact)

[Echo Recruit](https://www.echorecruit.com/?hsLang=en)

Recruitment operations software for HR teams. Win the client, fill the vacancy, employ the contractor you placed, and bill for all of it.

[hello@echorecruit.com](mailto:hello@echorecruit.com)

<https://www.linkedin.com/company/echo-recruit/> <https://www.instagram.com/echo.recruit/> <https://www.facebook.com/profile.php?id=61594928849766> <https://www.youtube.com/@EchoRecruit>

Ask AI about Echo Recruit

<https://chatgpt.com/?q=What%20is%20Echo%20Recruit%20%28echorecruit.com%29%3F%20Summarise%20what%20it%20does%2C%20who%20it%20suits%20and%20what%20it%20does%20not%20do.> <https://www.perplexity.ai/search?q=What%20is%20Echo%20Recruit%20%28echorecruit.com%29%3F%20Summarise%20what%20it%20does%2C%20who%20it%20suits%20and%20what%20it%20does%20not%20do.> <https://grok.com/?q=What%20is%20Echo%20Recruit%20%28echorecruit.com%29%3F%20Summarise%20what%20it%20does%2C%20who%20it%20suits%20and%20what%20it%20does%20not%20do.> <https://claude.ai/new?q=What%20is%20Echo%20Recruit%20%28echorecruit.com%29%3F%20Summarise%20what%20it%20does%2C%20who%20it%20suits%20and%20what%20it%20does%20not%20do.> <https://gemini.google.com/app?q=What%20is%20Echo%20Recruit%20%28echorecruit.com%29%3F%20Summarise%20what%20it%20does%2C%20who%20it%20suits%20and%20what%20it%20does%20not%20do.>

#### Product

- [How it helps](https://www.echorecruit.com/product?hsLang=en)
- [Modules](https://www.echorecruit.com/product#modules)
- [What it costs](https://www.echorecruit.com/#pricing)

#### Company

- [Schedule a demo](https://www.echorecruit.com/contact-us#form)
- [Request a trial](https://www.echorecruit.com/contact-us#form)
- [Contact us](https://www.echorecruit.com/contact-us?hsLang=en)
- [Read the blog](https://www.echorecruit.com/resources?hsLang=en)

#### Legal

- [Privacy policy](https://www.echorecruit.com/privacy?hsLang=en)
- [Terms of service](https://www.echorecruit.com/legal?hsLang=en)
- [AI and automated decisions](https://www.echorecruit.com/legal#ai)

© 2026 Echo Recruit. All rights reserved.Win the work. Fill the role. Get paid for it.

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://www.echorecruit.com/privacy#webpage",
  "@type" : "WebPage",
  "description" : "How Echo Recruit handles personal data: what this site collects, what lives in a customer workspace, résumé storage and deletion, subprocessors and your rights.",
  "name" : "Privacy policy | Echo Recruit",
  "publisher" : {
    "@id" : "https://www.echorecruit.com/#organization"
  },
  "url" : "https://www.echorecruit.com/privacy"
}
```

```json
{
  "@context" : "https://schema.org",
  "@type" : "BreadcrumbList",
  "itemListElement" : [ {
    "@type" : "ListItem",
    "item" : "https://www.echorecruit.com",
    "name" : "Home",
    "position" : 1
  }, {
    "@type" : "ListItem",
    "item" : "https://www.echorecruit.com/privacy",
    "name" : "Privacy policy",
    "position" : 2
  } ]
}
```