Privacy Policy

Recruiter Machine LLC (“Recruiter Machine,” “we,” “us,” or “our”) operates the Recruiter Machine platform, website located at recruitermachine.com, and all associated products and services (collectively, the “Services”).

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information in connection with the Services. It applies to:

• Visitors to our website (recruitermachine.com and subdomains)
• Customers and subscribers who purchase or use the Recruiter Machine platform
• Platform users (recruiters, managers, and team members) who access the platform on behalf of a subscribing organization
• Candidates whose personal information is entered into the platform by our customers
• Affiliates, referral partners, and job applicants who interact with Recruiter Machine

This policy does not apply to the privacy practices of third-party services that Recruiter Machine integrates with (such as LinkedIn, Indeed, Google, or Stripe). Those services have their own privacy policies, which we encourage you to review.

2.1 Information You Provide Directly

Account and subscription information. When you sign up for a Recruiter Machine plan, we collect your name, email address, phone number, company name, billing address, and payment information. Payment card data is processed and stored by our payment processor (Stripe, Inc.) and is not stored on Recruiter Machine systems.

Profile and settings information. Once your account is active, you may provide additional information including recruiter names, job titles, company branding assets, calendar availability, and platform configuration preferences.

Communications. When you contact us by email, phone, chat, or form submission, we collect the content of those communications and associated contact information.

Onboarding information. During the platform onboarding process, we collect information about your recruiting workflow, team structure, job types, and integration requirements to configure the platform for your use.

Affiliate and referral program information. If you apply to or participate in the affiliate program or referral bonus program, we collect your name, contact information, payment details, and information about your referral activities.

Job applications. If you apply for a position at Recruiter Machine, we collect your resume, cover letter, work history, references, and other information you provide during the hiring process.

2.2 Information Collected Automatically

Log data and usage information. When you visit our website or use the platform, our servers automatically record: IP address, browser type and version, operating system, pages visited and time spent, links clicked, referring URL, and timestamps of access.

Device information. We collect information about the device used to access our Services, including device type, screen resolution, and device identifiers.

Platform activity data. Within the platform, we log user actions including pipeline moves, messages sent, sequences triggered, workflows executed, and configuration changes. This activity data is used to populate dashboards, generate analytics, and audit logs.

Cookies and similar technologies. We use cookies and similar tracking technologies on our website. See Section 7 for details.

2.3 Information from Third-Party Integrations

When you connect third-party services to Recruiter Machine (such as Google Calendar, Gmail, LinkedIn, or Indeed), we receive information from those services as permitted by your authorization and the third party’s API policies. This may include:

• Calendar availability and event data (Google Calendar, Microsoft Outlook)
• Email messages associated with candidate communications (Gmail, Outlook)
• Candidate profile data from job boards (LinkedIn, Indeed)
• Payment and invoice data (Stripe, QuickBooks)

The scope of data received from third-party integrations is controlled by the permissions you grant when authorizing the connection. You may revoke integration access at any time from within the platform settings.

2.4 Information About Candidates

Our customers use the Recruiter Machine platform to manage information about job candidates. This information is entered into the platform by our customers or their authorized users and may include candidates’ names, contact information, employment history, pre-screening responses, interview notes, communication logs, and other recruiting-related data. See Section 6 for how we handle this data.

We use the personal information we collect for the following purposes:

3.1 Providing and Operating the Services

• Creating and managing your account
• Configuring and personalizing the platform to your specifications
• Processing transactions and managing billing
• Sending automated communications you have configured (sequences, reminders, notifications)
• Providing customer support and responding to inquiries
• Operating the affiliate and referral programs

3.2 Improving the Services

• Analyzing usage patterns to improve platform functionality and user experience
• Identifying and resolving technical issues, bugs, and security vulnerabilities
• Developing new features and capabilities
• Conducting internal research and quality assurance testing

3.3 Communications

• Sending transactional communications (receipts, account notices, security alerts)
• Sending service-related updates including platform changes, maintenance, and outages
• Sending marketing and promotional communications about Recruiter Machine products and features (you may opt out at any time)
• Responding to your questions, feedback, and requests

3.4 Legal and Compliance

• Enforcing our Terms of Service and Subscription Agreement
• Complying with applicable laws, regulations, and legal process
• Protecting the rights, property, and safety of Recruiter Machine, our customers, and others
• Detecting and preventing fraud, spam, and unauthorized access

3.5 Legal Bases for Processing (EEA/UK)

For individuals located in the European Economic Area (EEA) or United Kingdom (UK), we process personal information under the following legal bases:

• Contract performance: Processing necessary to provide the Services under our Subscription Agreement
• Legitimate interests: Improving the platform, preventing fraud, maintaining security, and sending relevant business communications
• Legal obligation: Compliance with applicable laws and regulations
• Consent: Marketing communications and non-essential cookies (where consent is required by law)

We do not sell your personal information. We do not share personal information with third parties for their own marketing purposes. We share information only as described below.

4.1 Service Providers

We share personal information with vendors and service providers who perform services on our behalf, including:

• Cloud infrastructure and hosting: Servers and data storage that power the platform
• Payment processing: Stripe, Inc. processes payment card transactions
• SMS and calling infrastructure: Twilio, Inc. provides the SMS and phone number infrastructure for automated communications
• Email delivery: Email service providers that deliver transactional and platform emails
• Analytics: Tools that help us understand how visitors interact with our website
• Customer support: Software used to manage and respond to support requests
• Integration infrastructure: GoHighLevel provides underlying CRM and automation platform infrastructure

All service providers are contractually required to use personal information only to provide services to us and to implement appropriate security measures.

4.2 At Your Direction

We share information with third-party services when you explicitly authorize connections, such as Google Calendar, Gmail, LinkedIn, Indeed, Salesforce, HubSpot, or QuickBooks. These connections are made at your request and subject to the privacy policies of those third parties.

4.3 Within Your Organization

For team and enterprise accounts, information may be shared with other authorized users within your organization based on the role-based permission structure you configure. Managers can access recruiter-level data; administrators can access all organizational data as permitted by your plan.

4.4 Legal Requirements

We may disclose personal information when we believe in good faith that disclosure is necessary to:

• Comply with a court order, subpoena, warrant, or other legal process
• Respond to lawful requests from government authorities
• Protect the rights, property, or safety of Recruiter Machine, our customers, or the public
• Enforce our agreements or investigate potential violations

Where legally permitted, we will attempt to notify you of such disclosure before complying.

4.5 Business Transfers

If Recruiter Machine is acquired by or merged with another company, or if substantially all of our assets are transferred to another organization, personal information we hold may be transferred as part of that transaction. We will notify affected users through our website or email prior to any such transfer and explain options available to you.

4.6 Aggregate and De-Identified Data

We may share aggregate, anonymized, or de-identified information that cannot reasonably be used to identify any individual for purposes such as industry benchmarking, product research, and marketing materials.

We retain personal information for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.

Upon expiration of the applicable retention period, we securely delete or anonymize personal information. If deletion is technically infeasible (e.g., data in backup systems), we isolate the data from further processing until deletion is possible.

You may request deletion of your personal information before the end of the retention period. See Section 9 for information about your rights.

Recruiter Machine customers use the platform to collect and manage personal information about job candidates. In this context:

• The customer (the subscribing organization or recruiter) is the data controller — they determine what candidate data is collected, for what purposes, and for how long
• Recruiter Machine is the data processor — we store and process candidate data solely to provide the Services to the customer, according to the customer’s instructions and our Subscription Agreement

6.1 What Candidate Data May Include

Depending on how a customer configures the platform, candidate data may include: full name, email address, phone number, physical address, employment history, resume and cover letter, pre-screening form responses, interview notes, communication logs (texts and emails sent through the platform), stage movement history, source attribution, and any custom fields the customer creates.

6.2 Our Obligations as Data Processor

As a data processor, Recruiter Machine:

• Processes candidate data only on documented instructions from the customer
• Does not use candidate data for our own marketing, profiling, or any purpose other than providing the Services
• Does not sell or share candidate data with third parties except as directed by the customer or as required by law
• Implements appropriate technical and organizational measures to protect candidate data
• Notifies customers without undue delay if we become aware of a personal data breach affecting candidate data
• Deletes or returns candidate data upon termination of the customer’s subscription, according to our data deletion procedures
• Provides customers with information necessary to demonstrate compliance with applicable data protection law

6.3 Candidates Seeking to Exercise Rights

If you are a candidate whose personal information has been entered into Recruiter Machine by one of our customers and you wish to access, correct, or delete your data, you should contact the organization (the customer) that collected your information. Recruiter Machine will assist our customers in responding to your request in accordance with applicable law.

If you cannot identify or reach the customer organization, contact us at [email protected] and we will attempt to connect you with the appropriate customer or advise on available options.

6.4 Data Processing Agreement

Customers who require a formal Data Processing Agreement (DPA) for GDPR compliance or other regulatory purposes may request one by contacting [email protected]. A DPA is available to all Team plan subscribers and to Solo plan subscribers upon request.

Our website uses cookies and similar technologies to operate the site, remember your preferences, and analyze how visitors interact with our content.

7.1 Types of Cookies We Use

7.2 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, and be notified when new cookies are set. Note that disabling certain cookies may affect the functionality of our website.

For opt-out tools specific to analytics providers, visit the Network Advertising Initiative opt-out page at optout.networkadvertising.org or the Digital Advertising Alliance opt-out page at optout.aboutads.info.

7.3 Do Not Track

Some browsers include a “Do Not Track” (DNT) signal. Because there is no universally accepted standard for how to respond to DNT signals, our website does not currently respond differently based on a DNT signal. We will update this section if a standard is adopted.

We implement technical and organizational security measures designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These measures include:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security)
• Encryption at rest: Stored data is encrypted at the infrastructure level
• Access controls: Role-based access controls limit who can access data within Recruiter Machine systems; employee access is limited to the minimum necessary to perform job functions
• Authentication: Multi-factor authentication is available and encouraged for all platform accounts
• Infrastructure security: We use cloud infrastructure providers that maintain industry-standard security certifications
• Regular security reviews: We conduct periodic reviews of our security practices and respond to identified vulnerabilities
• Incident response: We maintain procedures for detecting, reporting, and responding to security incidents

8.1 Security Breach Notification

In the event of a personal data breach that poses a high risk to your rights and freedoms, we will notify affected individuals without undue delay, and in any case within 72 hours of becoming aware of the breach where required by applicable law. We will also notify applicable supervisory authorities as required. Notification will include the nature of the breach, the categories and approximate number of individuals and records affected, likely consequences, and measures taken or proposed to address the breach.

9.1 General Rights

Regardless of where you are located, you may:

• Access your account data by logging into the platform at any time
• Update your personal information through your account settings
• Delete your account by canceling your subscription and submitting a deletion request to [email protected]
• Opt out of marketing emails by clicking the unsubscribe link in any marketing email or by contacting us
• Export your data during the 30-day window after account cancellation, or at any time during your active subscription by contacting support

9.2 Rights Under GDPR (EEA and UK Residents)

If you are located in the European Economic Area or United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Right of access: Request a copy of the personal information we hold about you
• Right to rectification: Request correction of inaccurate or incomplete personal information
• Right to erasure (“right to be forgotten”): Request deletion of your personal information, subject to certain exceptions (e.g., legal obligations)
• Right to data portability: Receive your personal information in a structured, machine-readable format and transmit it to another controller
• Right to restrict processing: Request that we limit how we use your personal information in certain circumstances
• Right to object: Object to processing of your personal information based on our legitimate interests or for direct marketing purposes
• Rights related to automated decision-making: Not to be subject to solely automated decisions that produce significant legal or similarly significant effects on you
• Right to withdraw consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. If your request is complex or numerous, we may extend the response period by an additional 60 days and will notify you of the extension.

You also have the right to lodge a complaint with your local data protection supervisory authority. In the EEA, find your authority at edpb.europa.eu. In the UK, contact the Information Commissioner’s Office (ICO) at ico.org.uk.

9.3 Rights Under CCPA / CPRA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with the following rights:

• Right to know: Request information about the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the purposes for collection, and the categories of third parties with whom we share it
• Right to delete: Request deletion of personal information we have collected, subject to certain exceptions
• Right to correct: Request correction of inaccurate personal information
• Right to opt out of sale or sharing: We do not sell personal information or share it for cross-context behavioral advertising. No opt-out action is required, but you may submit a request to confirm this at any time
• Right to limit use of sensitive personal information: Limit our use of sensitive personal information to providing the Services you have requested
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights

To submit a CCPA request, email [email protected] or call +1 855-779-0317. We will verify your identity before processing the request. Authorized agents may submit requests on your behalf with appropriate written authorization.

We will respond to verifiable consumer requests within 45 days. If we require additional time (up to 90 days total), we will notify you of the extension.

9.4 Verifying Your Identity

To protect your information, we verify your identity before responding to access, deletion, or portability requests. Verification typically involves confirming information associated with your account. For high-sensitivity requests, we may require additional verification steps. We will not charge a fee for responding to verifiable requests unless the request is manifestly unfounded or excessive.

Recruiter Machine is a platform through which our customers send automated SMS and email messages to candidates as part of their recruiting workflows. This section describes how SMS communications are handled.

10.1 A2P 10DLC Registration

All SMS communications sent through the Recruiter Machine platform use numbers registered under the Application-to-Person (A2P) 10DLC framework required by US mobile carriers. Each customer account is registered with a dedicated phone number, brand registration, and campaign registration that comply with carrier guidelines.

10.2 Message Content and Consent

Customers are responsible for ensuring that candidates have provided appropriate consent to receive SMS communications before entering candidate phone numbers into the platform. Recruiter Machine provides opt-out handling infrastructure — candidates who reply STOP, UNSUBSCRIBE, CANCEL, or similar keywords are automatically removed from active sequences and flagged as Do Not Contact. This opt-out is enforced at the platform level and is permanent unless the candidate re-consents.

10.3 Recruiter Machine’s Own SMS Communications

We may send SMS messages to customers and platform users for account-related purposes (security alerts, onboarding reminders, support follow-ups) where you have provided your phone number and agreed to receive such messages. You may opt out of non-essential SMS communications at any time by texting STOP in response to any message from us.

10.4 Message and Data Rates

Standard message and data rates from your mobile carrier may apply to SMS messages sent through or by the platform. Recruiter Machine does not charge additional per-message fees to customers on standard plans; carrier costs are included in plan pricing within normal operating volumes.

The Recruiter Machine platform integrates with numerous third-party services including Google Workspace, Microsoft Outlook, LinkedIn, Indeed, Zoom, Stripe, Twilio, Calendly, QuickBooks, Salesforce, HubSpot, Workday, Zapier, and Make. Our website may contain links to third-party websites.

This Privacy Policy does not govern the privacy practices of these third-party services. When you connect a third-party integration or visit a linked website, that third party’s privacy policy applies to how they handle your data. We encourage you to review the privacy policies of any third-party service you connect or visit.

Recruiter Machine is not responsible for the privacy practices, security, or content of third-party websites or services.

Key Third-Party Privacy Policies

• Google: policies.google.com/privacy
• Microsoft: privacy.microsoft.com
• LinkedIn: linkedin.com/legal/privacy-policy
• Stripe: stripe.com/privacy
• Twilio: twilio.com/legal/privacy
• Zoom: zoom.us/privacy

Recruiter Machine is headquartered in the United States. If you are located outside the United States, your personal information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

For transfers of personal information from the EEA, UK, or Switzerland to the United States, we rely on appropriate safeguards including:

• Standard Contractual Clauses (SCCs): EU-approved contractual terms incorporated into agreements with service providers and customers where required
• UK International Data Transfer Agreements (IDTAs): For transfers from the UK where applicable
• Data Processing Agreements: Available to customers on request (see Section 6.4)

By using the Services, you acknowledge that your information may be transferred to and processed in the United States. If you have questions about cross-border data transfers, contact [email protected].

The Recruiter Machine platform and website are not directed at children under the age of 16, and we do not knowingly collect personal information from children under 16.

If you believe we have inadvertently collected information from a child under 16, please contact us immediately at [email protected] and we will take steps to delete such information promptly.

Our customers who use the platform to recruit must not collect personal information from candidates under 16 without appropriate parental or guardian consent as required by applicable law. Customers are responsible for ensuring compliance with applicable law regarding the age of candidates they recruit using the platform.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the “Effective Date” at the top of this page
• Post the revised policy on this page
• Send email notice to customers with active subscriptions at least 30 days before material changes take effect (for changes that significantly affect how we process personal information)
• Display a notice on the platform or website for non-material updates

Your continued use of the Services after the effective date of any updated policy constitutes your acceptance of the changes. If you do not agree to the updated policy, you should discontinue use of the Services before the effective date.

We encourage you to review this policy periodically to stay informed about how we protect your information.

If you have questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us:

For EEA or UK residents who have unresolved privacy concerns that we have not addressed satisfactorily, you have the right to contact your local data protection supervisory authority. See Section 9.2 for authority contact information.