Last updated 2026-10-29
1. Roles
The organization is the controller of the personal data it brings to Rankr, in particular data about candidates. Gearlay is the processor and processes that data only on the organization's documented instructions, which are the use of the service as described in the privacy policy and the settings the organization chooses.
2. Subject matter and duration
Processing covers running assessment exercises, drafting and storing scores, and supporting the organization's hiring process, for as long as the organization uses Rankr plus the deletion period in section 8.
3. Data and people concerned
Candidates: name, email, CV where attached, work done in exercises, prompts and assistant replies, scores and notes. Interviewers: name, email, role, actions in the audit log.
4. Our obligations
- Process personal data only on the organization's instructions, unless the law requires otherwise, in which case we tell the organization first where allowed.
- Keep everyone with access bound by confidentiality.
- Apply the security measures described on the security page, including isolation per organization, encrypted storage and transport, scoped access and an audit log.
- Help the organization answer requests from candidates, by providing export and erasure of a candidate's data in the console.
- Help with data protection impact assessments and consultations with authorities where relevant, with the information we hold.
- Tell the organization's owners without undue delay, and at most within seventy-two hours of becoming aware, of a personal data breach affecting their data, with what we know and what we are doing.
5. Subprocessors
The organization authorizes the following subprocessors: Anthropic and OpenAI for model inference, Stripe for payments, the hosting and database provider for storage and compute, and the email provider for transactional email. We tell organization owners by email at least fourteen days before adding or replacing a subprocessor; an organization that objects on reasonable grounds may end the service without penalty before the change applies.
6. International transfers
Where a subprocessor processes data outside the organization's region, the transfer relies on standard contractual clauses or another mechanism recognised by the applicable law, and we provide the details on request.
7. Audits
We provide the information needed to show compliance with these terms, and once a year, or after a breach, allow an audit by the organization or an auditor it mandates, on thirty days' notice, during business hours, under confidentiality, at the organization's cost.
8. Deletion
Erasing a candidate in the console removes their data at once from the live database. When an organization closes, its data is erased within thirty days. Backups holding erased data are overwritten within thirty days. We keep only what the law requires us to keep, such as billing records.
9. Liability
Liability under these terms follows the terms of service, except where data protection law sets a different rule that cannot be changed by contract.
Contact
Data protection questions go to rankr@localhost.