Privacy Policy

1. Introduction

Eira Technology AB, org. nr 559579-7217, (“we”, “us”, “our”) is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our AI-powered recruitment platform and related services (the “Platform”).

We are a Swedish company and act as the data controller for the personal data described in this policy. We comply with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Swedish Data Protection Act (dataskyddslagen, SFS 2018:218), the Swedish Supplementary Provisions Act (lag med kompletterande bestämmelser till EU:s dataskyddsförordning, SFS 2018:218), and all other applicable data protection legislation.

This policy applies to all individuals whose personal data we process, including candidates, employers, hiring managers, platform users, website visitors, and any other individuals who interact with us or our Platform.

2. Data Controller and Contact Information

2.1 Privacy Contact

We have designated an internal privacy lead responsible for overseeing data protection matters within our organisation. For any privacy-related questions, data subject requests, or concerns, please contact us at [email protected] .

We continuously assess whether a formal Data Protection Officer (DPO) is required under Article 37 GDPR, taking into account the nature, scope, and scale of our processing activities. As our operations grow, we will appoint a DPO if and when required by law, and will update this policy accordingly.

2.2 Supervisory Authority

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY): IMY: Box 8114, 104 20 Stockholm | imy.se | [email protected]

3. Key Definitions

• Personal Data: Any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR.
• Special Category Data: Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person’s sex life or sexual orientation, as defined in Article 9 GDPR.
• Processing: Any operation performed on personal data, whether automated or not, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, erasure, or destruction.
• Data Subject: The identified or identifiable natural person to whom personal data relates.

4. Categories of Personal Data We Collect

We collect and process the following categories of personal data, depending on your relationship with us and how you interact with the Platform:

4.1 Candidate Data

• Contact Information: Name, email address, phone number, postal address.
• Professional Profile: CV/resume, work history, education, skills, certifications, role preferences, salary expectations, location preferences, LinkedIn profile, and other recruitment-related information.
• Interview Data: Voice recordings and transcripts from AI-powered interviews, AI-generated assessments, fit scores, rankings, and candidate summaries.
• User-Generated Content: Files, documents, or materials you upload to the Platform.
• Profile Photo: If you upload a profile picture, or if one is imported from your LinkedIn profile upon sign-in.
• Language and Platform Preferences: Your preferred language, notification settings, and other platform preferences.
• Third-Party Sign-In Data: If you sign in using LinkedIn, we receive your name, email address, profile picture, and professional headline from LinkedIn via their OAuth authentication service. We do not receive or store your LinkedIn password.
• Communication Data: Messages, emails, and other correspondence with us or through the Platform.

4.2 Employer and Hiring Manager Data

• Contact Information: Name, email address, phone number, company details.
• Account Information: Login credentials, account settings, and preferences.
• Billing and Invoicing Data: Organisation number, billing address, invoicing contact person, VAT number, payment history, and bank account details for invoicing purposes.
• Recruitment Activity Data: Records of candidate introductions, engagements, and related correspondence.
• Job Listing Data: Job descriptions, requirements, and related hiring criteria.

4.3 Technical and Usage Data

• Device Information: IP address, browser type and version, operating system, device identifiers.
• Usage Data: Pages visited, features used, time spent on Platform, access logs, clickstream data.
• Cookies and Similar Technologies: See Section 12 (Cookies) for details.

4.4 Special Category Data

We do not actively collect, solicit, or request Special Category Data (sensitive personal data as defined in Article 9 GDPR). However, because our Platform includes AI-powered interviews where candidates speak freely, such data may be incidentally present in voice recordings and transcripts. Examples include:

• Health or disability (e.g., if a candidate mentions an accommodation need during an interview)
• Ethnic origin or nationality (e.g., if disclosed during conversation or included in a CV)
• Trade union membership (if voluntarily mentioned)
• Religious beliefs (e.g., if mentioned in relation to scheduling or work preferences)

How we handle incidental Special Category Data: When sensitive information is disclosed during an AI interview, it remains within the voice recording and transcript only. We do not extract, tag, categorise, analyse, or otherwise separately process this data. It is not used to generate assessments, fit scores, or recommendations, and it is never shared with Employers. The data is retained solely as part of the recording and transcript, subject to the retention periods in Section 9 (6 months for recordings, 24 months for transcripts).

Legal basis: The incidental presence of Special Category Data in recordings and transcripts constitutes processing under GDPR. Our legal basis for this processing is that the data has been manifestly made public by the data subject (Article 9(2)(e) GDPR) — you voluntarily chose to disclose this information during the interview. Additionally, before participating in an AI interview, you are informed that your conversation will be recorded and transcribed, and that anything you say will form part of that recording.

Our commitment: We strongly encourage candidates not to share sensitive personal information during interviews unless they consider it relevant. We continuously review our AI systems to ensure that Special Category Data incidentally captured in recordings does not influence assessments or matching outcomes.

4.5 Mandatory and Optional Data

Some personal data is required in order for us to provide our services to you, while other data is optional. Below we clarify which data is mandatory and what happens if you choose not to provide it:

For employers and hiring managers, account creation requires a company name, contact person name, email address, and billing information (organisation number, billing address, and invoicing contact). Billing data is mandatory for employers and is required for invoicing of Success Fees. Job listing data is required to use the matching features of the Platform.

5. Purposes of Processing and Legal Bases

Below we set out the specific purposes for which we process your personal data, together with the corresponding legal basis under Article 6(1) GDPR and, where applicable, Article 9(2) GDPR.

5.1 Legitimate Interest Balancing Tests

Where we rely on legitimate interest (Article 6(1)(f) GDPR) as a legal basis, we have conducted balancing tests to ensure our interests do not override your fundamental rights and freedoms. A summary of our key assessments is set out below:

• Recruitment Matching: Our interest is to connect candidates with relevant job opportunities, which is the core purpose of our Platform and directly benefits candidates. We mitigate risks by allowing candidates to control their profile visibility and opt out at any time. We have concluded that the benefit to both candidates and employers outweighs any potential intrusion, particularly given the voluntary nature of using the Platform.
• AI Processing & Improvement: Our interest is to improve the accuracy and fairness of our matching algorithms. We use anonymised and aggregated data wherever possible. Where personal data is used, we implement strict access controls and purpose limitation. The improvement of AI systems ultimately benefits all users through better matching outcomes.
• Platform Security: Our interest is to prevent fraud, detect security threats, and maintain platform integrity. This processing is limited to what is necessary for security purposes, and the data is retained for a limited period (12 months). All users benefit from a secure platform.
• Analytics & Improvement: Our interest is to understand usage patterns and improve the user experience. We use aggregated data and minimise the collection of identifiable information. Users benefit directly from platform improvements.

You have the right to object to processing based on legitimate interest at any time (see Section 10). You may also request a copy of our full balancing test documentation by contacting us at [email protected] .

6. AI-Powered Processing and Automated Decision-Making

Our Platform uses artificial intelligence to facilitate the recruitment process. Transparency about how this works is important to us.

6.1 How Our AI Works

• Our AI conducts structured interviews with candidates, recording and transcribing conversations to generate assessments.
• The AI analyses candidate profiles, skills, and experience against job requirements to generate fit scores, rankings, and candidate summaries.
• These AI-generated outputs are used to support recruitment decisions but are not the sole basis for any hiring decision.

6.2 Automated Decision-Making (Article 22 GDPR)

We use automated processing to generate candidate assessments and match scores. However, no hiring decision is made solely on the basis of automated processing. All final recruitment decisions involve meaningful human review and oversight.

Where automated processing produces recommendations that significantly affect you, you have the right to:

• Obtain human intervention in the decision-making process
• Express your point of view regarding the automated assessment
• Contest any decision based on automated processing

To exercise these rights, contact us at [email protected] .

6.3 AI Safeguards

• We regularly audit AI decision outcomes for accuracy, bias, and fairness.
• We do not use voice recordings to create biometric voiceprints.
• We do not sell or license personal data to train third-party AI models.
• Anonymised and aggregated data may be used to improve our algorithms, but this data cannot be used to identify you.

7. Data Sharing and Recipients

We may share your personal data with the following categories of recipients, and only to the extent necessary for the stated purposes:

7.1 Employers and Hiring Partners (Controller-to-Controller Sharing)

Ghost is the independent data controller for all candidate data collected and processed through the Platform. When we share candidate data with an Employer through the Platform, the Employer becomes a separate, independent data controller for that data in relation to its own recruitment purposes.

This means that Ghost and the Employer each bear independent responsibility for compliance with the GDPR in respect of the personal data they control. We are not joint controllers (Article 26 GDPR).

If you are a candidate, your professional profile and AI-generated assessment summaries may be shared with prospective employers using the Platform. This sharing is based on the performance of our contractual obligations to you and our legitimate interest in facilitating recruitment (Article 6(1)(b) and 6(1)(f) GDPR). You can control visibility settings in your account at any time. Voice recordings, raw transcripts, and any Special Category Data are never shared with Employers.

Employers are contractually required under our Terms of Service to use candidate data exclusively for evaluating candidates for roles within their own organisation, to comply with all applicable data protection laws, and to delete candidate data within six (6) months of an Introduction if the candidate is not Engaged. For full details, see Section 7 of our Terms of Service.

7.2 Sub-Processors and Service Providers

We engage third-party service providers who process personal data on our behalf. These sub-processors are bound by Data Processing Agreements (DPAs) in accordance with Article 28 GDPR. Current categories of sub-processors include:

• Railway Corporation — Application server hosting (hosted in EU region).
• OpenAI, L.L.C. — AI language model inference and text embeddings for candidate matching and interview analysis.
• ElevenLabs, Inc. — AI-powered voice interview processing, transcription, and conversational analysis.

We also integrate with the following third-party services where personal data may be shared at the user's direction:

• LinkedIn (Microsoft Corporation) — OAuth-based authentication and profile data import during candidate onboarding, initiated by the user.

A current list of our sub-processors is available upon request by emailing [email protected] .

7.3 Professional Advisors

We may share personal data with our legal counsel, accountants, auditors, and insurers where necessary for the provision of their professional services.

7.4 Regulatory and Government Authorities

We may disclose personal data where required by applicable law, regulation, legal process, or governmental request, or where necessary to protect our rights, privacy, safety, or property, or that of our users or the public.

7.5 No Selling of Personal Data

We do not sell your personal data to any third party, under any circumstances.

8. International Data Transfers

Your personal data is primarily stored and processed within the European Economic Area (EEA). However, some of our sub-processors may be located outside the EEA.

Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR (Articles 44–49), including:

• Transfers to countries with an adequate level of data protection as determined by the European Commission (Article 45 GDPR)
• Standard Contractual Clauses (SCCs) approved by the European Commission (Article 46(2)(c) GDPR)
• Where applicable, supplementary measures as recommended by the European Data Protection Board (EDPB)

You may request a copy of the safeguards in place by contacting us at [email protected] .

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our retention periods are as follows:

When personal data is no longer required, it will be securely deleted or anonymised. Where complete deletion is not technically feasible, we will implement measures to prevent further processing.

10. Your Rights Under GDPR

As a data subject, you have the following rights under the GDPR. You may exercise any of these rights at any time by contacting us at [email protected] .

• Right of Access (Article 15): You have the right to obtain confirmation of whether we process your personal data, and if so, to access that data and receive a copy.
• Right to Rectification (Article 16): You have the right to have inaccurate personal data corrected and incomplete data completed.
• Right to Erasure (Article 17): You have the right to request the deletion of your personal data where there is no compelling reason for its continued processing.
• Right to Restriction (Article 18): You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of the data.
• Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller.
• Right to Object (Article 21): You have the right to object to processing based on legitimate interests, including profiling. You also have the absolute right to object to direct marketing at any time.
• Rights Related to Automated Decision-Making (Article 22): You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. See Section 6.2 above.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

Response Times: We will respond to your request without undue delay and in any event within one (1) month. This period may be extended by two further months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receipt of the request.

Verification: We may need to verify your identity before processing your request. We will not charge a fee for exercising your rights unless the request is manifestly unfounded or excessive.

Right to Complain: If you are dissatisfied with how we handle your personal data or your rights request, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) at imy.se , or with the supervisory authority of your habitual residence or place of work within the EU/EEA.

11. Data Security

We implement appropriate technical and organisational measures in accordance with Article 32 GDPR to ensure a level of security appropriate to the risk, including:

• Encryption of personal data in transit (TLS/SSL) and at rest
• Strict access controls and role-based permissions
• Regular security assessments and penetration testing
• Employee training on data protection and information security
• Incident response and data breach management procedures
• Pseudonymisation and anonymisation of data where appropriate
• Regular backups and disaster recovery procedures

11.1 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Swedish Authority for Privacy Protection (IMY) without undue delay and no later than 72 hours after becoming aware of the breach, in accordance with Article 33 GDPR.

Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, in accordance with Article 34 GDPR.

12. Cookies and Similar Technologies

Our Platform uses cookies only where needed for functions such as authentication and language preferences. Disabling these cookies in your browser may affect the functionality of the Platform.

Our first-party audience measurement does not use cookies, local storage or persistent visitor identifiers to identify visitors. To estimate daily unique visitors, the server creates a one-way identifier from a daily random key, the site, the request IP address and User-Agent. The raw IP address and User-Agent are not stored. The random key changes each UTC day and expired keys are deleted, preventing recognition across days. A person may also be counted again when changing device, browser or network.

Devices used to access our internal administration area receive a necessary, non-identifying exclusion cookie. It is used only to prevent internal traffic from entering our analytics and is retained for up to 400 days.

Analytics is limited to route patterns without identifying URL parameters, referring hostnames, allowlisted campaign parameters, country, coarse device/browser/operating-system categories and engagement time. Raw analytics events are retained for at most 90 days. See our Cookie Policy for further details.

13. Age Requirements

Our Platform is intended for individuals aged 18 and over, as set out in our Terms of Service. The minimum age of 18 reflects the requirements of entering into a binding contract and the employment-related nature of our Services.

Under the GDPR and Swedish supplementary legislation (dataskyddslagen), the minimum age for consenting to the processing of personal data in connection with information society services is 16 years. However, since our Platform requires users to be at least 18 to create an account, this higher threshold applies.

• Users must be at least 18 years old to create an account on the Platform (see our Terms of Service, Section 4.1).
• We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have collected personal data from a person under 18, we will take steps to delete that data promptly.
• If you believe that a minor has provided personal data to us, please contact us at [email protected] .

14. Direct Marketing

We may use your contact information to send you marketing communications about our services, new features, and other information we believe may be relevant to you.

We will only send you marketing communications where:

• You have given your explicit consent (opt-in) to receive such communications; or
• You are an existing user and the marketing relates to similar services to those you have previously used (soft opt-in), in accordance with the Swedish Electronic Communications Act (lag om elektronisk kommunikation, SFS 2022:482).

You may opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email, or by contacting us at [email protected] . Opting out of marketing will not affect the provision of our services to you.

15. Third-Party Links and Services

The Platform may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through our Platform.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

For material changes, we will notify you by email or through a prominent notice on the Platform before the changes take effect. We encourage you to review this policy periodically.

The “Effective Date” at the top of this document indicates when the latest version became effective.

17. Governing Law and Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of Sweden. Any disputes arising from or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the Swedish courts.

Nothing in this section limits your right to lodge a complaint with a supervisory authority under Article 77 GDPR or to seek a judicial remedy under Articles 78–79 GDPR.