Privacy Policy

1. Who we are

ScoreDesk is operated by [ Legal name — to be completed ], registered in the Netherlands.

For any privacy-related questions, contact us at: privacy@scoredesk.pro

2. What data we collect

Account & billing data

• Email address — collected when you sign up or purchase a subscription. Used to send your access code and product communications.
• Payment information — processed exclusively by Stripe. ScoreDesk never sees or stores your card number, bank details, or full billing information. Stripe's privacy policy applies to payment processing: stripe.com/privacy.
• Name — collected by Stripe at checkout. Used in onboarding emails.

Usage data

• Job descriptions — submitted by you to generate scorecards. These are sent to the Anthropic API for processing and are not stored by ScoreDesk after your session ends.
• Session data — basic technical logs (IP address, browser type, pages visited) collected automatically for security and performance monitoring.

What we do NOT collect

• Candidate personal data of any kind
• CVs or candidate documents
• Interview notes or scoring results
• Any data from the people you are interviewing

3. How we use your data

• To deliver the service (generate scorecards, provide access)
• To send transactional emails (access codes, receipts)
• To send product updates and improvement communications (you can unsubscribe at any time)
• To improve ScoreDesk's performance and fix technical issues
• To comply with legal obligations

4. Legal basis for processing (GDPR)

If you are located in the European Economic Area, we process your personal data on the following legal bases:

• Contract performance — processing your email and payment information to deliver the service you purchased.
• Legitimate interests — sending product communications and improving the service.
• Legal obligation — retaining billing records as required by applicable law.

5. Third-party services

ScoreDesk uses the following third-party services that may process your data:

• Stripe — payment processing. Data processed under Stripe's privacy policy.
• Anthropic — AI processing of job descriptions to generate scorecards. Job descriptions are processed but not retained. Anthropic's privacy policy applies.
• Resend — transactional email delivery (access codes, receipts).
• Vercel — hosting and infrastructure. Basic access logs may be retained.

We do not sell, rent, or share your personal data with any third party for marketing purposes.

6. Data retention

• Email address — retained while your account is active and for up to 2 years after account closure, unless you request deletion.
• Billing records — retained for 7 years as required by EU tax law.
• Job descriptions — not retained after session ends.
• Session logs — retained for up to 90 days.

7. Your rights (GDPR)

If you are in the EEA, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your personal data ("right to be forgotten")
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Restriction — request restriction of processing in certain circumstances

To exercise any of these rights, email privacy@scoredesk.pro. We will respond within 30 days.

You also have the right to lodge a complaint with your national data protection authority.

8. Cookies

ScoreDesk uses only essential cookies required for the service to function (session management, Stripe checkout). We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

9. Data security

We implement appropriate technical and organisational measures to protect your personal data, including HTTPS encryption, access controls, and regular security reviews. Payment data is handled exclusively by Stripe under PCI-DSS compliance.

10. International transfers

Some of our third-party providers (Anthropic, Vercel) are based in the United States. Data transfers are governed by appropriate safeguards including Standard Contractual Clauses where required under GDPR.

11. Changes to this policy

We may update this Privacy Policy periodically. Material changes will be notified by email to registered users. The "last updated" date at the top of this page reflects the most recent revision.

12. Contact

For any privacy questions or requests:
Email: privacy@scoredesk.pro
[ Postal address — to be completed once legal entity is registered ]