RecruitHelper
Legal

Data Processing Agreement

Last updated 17 September 2026

This agreement governs how Hamid Soheili, doing business as Soheili Labs processes personal data on behalf of a recruiting organization subscribing to RecruitHelper. It forms part of the Terms of Service and applies automatically to every subscription — you do not need to sign a separate copy, though we will sign one on request.

In this agreement you are the controller and we are the processor. You decide what to ask candidates, why, and how long to keep it. We process that data only to provide the service to you.

1. Subject matter and duration

We process candidate personal data so that you can run structured screenings, review responses, and manage a hiring pipeline. Processing lasts for as long as your subscription is active, plus the deletion period in section 8.

2. Nature and purpose of processing

Collecting screening responses through private candidate links; storing and displaying them to your team; recording the notes, tags, stages and decisions your team enters; exporting your data when you ask for it; and sending candidates the screening invitations and reminders you trigger.

RecruitHelper does not score, rank, filter or automatically reject candidates. It performs no automated decision-making or profiling within the meaning of Article 22 GDPR. Every evaluation is made by your team.

3. Categories of data subject and personal data

Data subjects: candidates you invite, and the members of your own team who use the workspace.

Candidate data: name, email address, the free-text answers they write, resume text where your team imports a resume, and the assessment data your team records about them — stage, stage history, notes, tags and decisions.

Team member data: name, email address, a salted scrypt hash of their password, organization role, and audit records of organization-level actions.

We do not ask candidates for special category data. Your screening questions are yours to write, so please do not use them to collect special category data without a lawful basis under Article 9 GDPR.

4. Our obligations

  • We process personal data only on your documented instructions. Your use of the service, and this agreement, are those instructions.
  • We tell you if an instruction appears to us to infringe applicable data protection law.
  • Everyone with access is bound by confidentiality obligations.
  • We do not sell personal data, use candidate responses to train machine learning models, or process it for our own purposes.

5. Security

The measures we maintain are described in the Privacy Policy and include:

  • encryption in transit with TLS;
  • salted scrypt password hashing, and signed, expiring sessions;
  • strict separation between organizations, so one customer's recruiting data is not reachable from another's;
  • high-entropy candidate links that expose no internal record identifiers and can be expired or revoked;
  • rate limiting on authentication and public endpoints;
  • daily backups, retained for 14 days, with off-site copies encrypted to a key the application server does not hold;
  • redaction of personal data and credentials from error reports before they leave the server.

6. Sub-processors

You authorise the following sub-processors:

  • Stripe — subscription payments and billing. Processes your billing contact data, not candidate data.
  • Resend — transactional email, including candidate screening invitations and reminders. Processes candidate names and email addresses.
  • Our hosting provider — the private server and database running the service.

We impose data protection obligations on each sub-processor no less protective than those in this agreement, and remain liable to you for their performance. We will give you reasonable notice before adding or replacing a sub-processor, and you may object on reasonable data protection grounds.

7. Location and transfers

Application data is stored in the United States. Our payment and email sub-processors may process data outside that region. Where a transfer requires a safeguard under Chapter V GDPR, it is made under Standard Contractual Clauses or another lawful transfer mechanism.

8. Deletion and return

  • Your team can permanently delete an individual candidate and their screening data at any time, from the candidate record.
  • You can export your organization's data from Company Settings at any time.
  • When you close your workspace, the data is retained for 30 days so that closure can be reversed, then permanently deleted on a schedule. Export anything you need before that period ends.
  • Backups age out on their retention cycle after deletion.

9. Assisting you

Taking into account the nature of the processing, we will assist you with:

  • responding to candidates exercising rights of access, correction, deletion, restriction, objection or portability. Most of these you can satisfy yourself from the workspace; where you cannot, ask us;
  • your obligations under Articles 32 to 36 GDPR, including security, breach notification, and any data protection impact assessment.

If we become aware of a personal data breach affecting your data, we will notify you without undue delay, with the information we hold about its nature, likely consequences and the measures taken.

10. Audit

We will make available the information reasonably necessary to demonstrate compliance with this agreement and will contribute to audits conducted by you or an auditor you mandate, on reasonable notice, no more than once a year unless a regulator or a breach requires otherwise, and subject to confidentiality.

11. Precedence

Where this agreement conflicts with the Terms of Service on the processing of personal data, this agreement prevails.

Contact

Data protection questions, sub-processor objections, and requests for a signed copy: privacy@soheililabs.com.