Privacy Policy

1. Introduction

ATSpro is a recruitment CRM ("we", "our", or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our recruitment CRM platform and related services.

The data controller for personal data we collect about ATSpro account holders is Laurence Doherty, contactable at privacy@atspro.co.uk.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

We collect information in the following ways:

Account Information: Name, email address, company name, phone number, and billing information when you register for an account.

Candidate Data: Information you upload about candidates including CVs, contact details, employment history, and notes. You are the data controller for this information.

Connected Account Data: If you connect a Google or Microsoft 365 account, the email and calendar data described in section 5.

Usage Data: Information about how you use our platform, including features accessed, actions taken, and time spent.

Technical Data: IP address, browser type, device information, and cookies.

3. How We Use Your Information

We use your information to:

• Provide and maintain our services
• Process transactions and send related information
• Send administrative information, updates, and security alerts
• Respond to your comments, questions, and support requests
• Analyse usage patterns to improve our platform
• Comply with legal obligations

4. Data Processing for AI Features

Our AI features process candidate and job data to provide matching, screening, and automation capabilities. AI processing uses Anthropic's Claude API and OpenAI's API for specific tasks. We do not use your data to train AI models, and our AI providers do not use data sent through their APIs to train their models. Your data remains yours.

5. Data from Connected Google and Microsoft Accounts

If you connect a Google account (Gmail and Google Calendar) or a Microsoft 365 account, ATSpro accesses:

• Your email messages and their details, so that emails with candidates and contacts are linked to the right records and replies are detected
• The ability to send email on your behalf, used to send emails you write or approve in ATSpro, and automated emails you have switched on (such as interview reminders)
• Your calendar, so that interviews and meetings can be created and kept in sync

This data is used only to provide these features to you. We store the access tokens needed to keep your account connected; for Microsoft 365, the sender, recipients, subject and a short preview of the last 90 days of inbox and sent messages so your mailbox loads quickly (full messages are fetched when you open them and are not stored); and a record of emails exchanged with candidates and contacts, linked to those records. It is stored in the UK and EU and is visible only to you and the users you authorise within your agency's account.

You can disconnect at any time in Settings, or revoke access from your Google or Microsoft account settings. Disconnecting deletes the access tokens and the stored message headers. Emails already logged against candidate and contact records remain part of those records, under your agency's control, until you delete them or close your account.

When you use AI features on your email, such as drafting a reply, the relevant message content is sent to our AI providers (Anthropic and OpenAI) to generate the result. It is not used to train AI models, ours or theirs. We do not sell this data or use it for advertising, and we do not read it except with your permission (for example, when you ask us to help with a support issue), for security purposes, or where required by law.

ATSpro's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Data Sharing

We do not sell your personal information. We may share data with:

• Service providers who assist in operating our platform (hosting, payment processing, email delivery)
• AI providers (Anthropic and OpenAI) that process data to deliver AI features
• Professional advisers including lawyers, auditors, and insurers
• Law enforcement or regulatory bodies when required by law

7. Data Retention

We retain your account information for as long as your account is active. Upon account closure, we delete your data within 90 days unless retention is required for legal purposes. You can request data export at any time.

8. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Object to processing
• Data portability
• Withdraw consent at any time

9. Security

We implement technical and organisational measures to protect your data: AES-256 encryption for stored credentials and other sensitive fields, TLS 1.2 or higher on all connections, two-factor authentication (TOTP) available for all users, separation between customers enforced on every request (your data cannot be accessed by another agency), signed sessions that end on logout or password change, and role-based access control. Your database, files and backups are stored in London (Neon and Amazon Web Services); the application runs on servers in the Netherlands (Railway). We use Sentry for error monitoring, with credentials and personal details removed from logs and error reports. See our Security & Data Protection page for details.

10. Contact Us

For privacy-related inquiries or to exercise your rights, contact us at privacy@atspro.co.uk.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.