Privacy Policy

Who we are

Kevaro is a recruitment CRM platform used by recruitment agencies ("Agencies") to manage their candidates, jobs, and placements. Each Agency is the data controller for the candidate and client data it enters into Kevaro — Kevaro acts as a data processor on the Agency's behalf, under instruction from that Agency.

What data we collect

Agency staff (users): name, work email, role, and account activity needed to run the service (login events, two-factor authentication status).

Candidates: name, contact details, CV contents, and application/pipeline history — entered by an Agency's users, or submitted directly by a candidate applying through an Agency's public careers page.

How AI features are used

Some Agencies opt in to AI features (CV parsing, candidate-to-job matching, and an "Ask AI" question tool). When enabled, these features send the relevant candidate or job text to Anthropic solely to generate the requested output — a parsed candidate profile, a match score, or an answer to a specific question. This is a direct integration with Anthropic's own API, not routed through a cloud reseller such as AWS Bedrock. Anthropic's EU entity, Anthropic Ireland Limited, is the contracting party under Standard Contractual Clauses, though the actual processing takes place in the United States. This data is not used to train Anthropic's models, and usage is capped per Agency each month. Agencies on plans without AI enabled never have their data sent to Anthropic.

Agencies with AI enabled can also turn on Opportunity Engine, which periodically (typically overnight) re-assesses existing candidates against roles that have opened up since they last applied, so they can be surfaced for something new without re-applying. It works the same way as the features above — a person still makes every actual decision, the AI only assists.

How long we keep data

Each Agency configures its own candidate data retention period (2 years by default). Once that period passes, the candidate is flagged for an Agency admin to review and remove — this is a prompt for a person to act, not an automatic deletion. A user can extend a specific candidate's retention, but only after confirming the candidate has actually agreed to stay on file — it isn't a routine bulk action.

Security

Sensitive personal data is encrypted at rest. Every account — every login, every time — requires two-factor authentication; this is enforced at the database level, not just as an app-side prompt. Each Agency's data is technically isolated from every other Agency using Kevaro.

Who we share data with

We don't sell personal data, and we don't share one Agency's candidate data with another Agency. Within the normal recruitment process, an Agency may share a candidate's details with the specific employer or client it's recruiting for on that candidate's behalf. We use a small number of infrastructure providers strictly to operate the service: Supabase (hosting and database), Netlify (hosting the public-facing pages), Resend (sends an Agency's own adviser transactional email — Opportunity Engine and retention-reminder notifications — which contain counts and status, never candidate CVs or personal details), Nylas (for Agencies where a team member connects their own work inbox — emails and calendar events with a candidate may then be shown on that candidate's record; Kevaro uses Nylas's European region, London, and only the adviser who connected their mailbox can see that content), and — for Agencies with AI enabled — Anthropic, as described above.

Your rights

Because the Agency you've dealt with is the data controller for your information, requests to access, correct, or delete your data should go to that Agency directly — they're best placed to action it, and we support them in doing so. If you're not sure which Agency holds your data, or can't reach them, contact us at the address below and we'll help.

Cookies

Kevaro uses only the essential, functional cookies needed to keep you signed in. We don't load third-party trackers or advertising cookies.

Changes to this policy

We'll update the date at the top of this page whenever this policy changes, and post the update here.

Contact

Questions about this policy: privacy@kevaro.ai