Privacy policy

Who this policy is from

Pulse Recruit is a recruitment applicant tracking system operated by RecruiterGTM. In this document, Pulse, we and us mean RecruiterGTM operating the Pulse Recruit service at www.pulserecruit.ai.

We are a small team and we do not have a Data Protection Officer, because the law does not require one at our scale and we would rather tell you that than name a role nobody holds. Every privacy question, data request or complaint goes to operations@recruitergtm.com and a person answers it.

The distinction that matters most: controller and processor

An applicant tracking system holds personal data about two different groups of people, and the same company is not responsible for both in the same way. Getting this right decides who a person goes to when they want their data.

For your account data, we are the data controller. We decided to collect your name and work email in order to run the service, so the decisions and the answers are ours.

For the candidate and client records inside your workspace, you are the data controller and we are your data processor. You chose to source those people, you decided what to record about them, and you decide how long to keep them. We hold and process those records on your instructions and for no purpose of our own.

In practice that means a candidate asking to be deleted asks you, not us, because it is your relationship and your lawful basis. If a candidate contacts us directly we will not act on their record ourselves. We will tell them who the controller is and pass the request to you without delay, then help you carry it out.

It also means you are responsible for having a lawful basis to hold the candidates you load, for telling them you hold their data, and for not loading categories of data the product is not built for. We do not accept health records, and Pulse is not built for them.

What we collect about you, the customer

This is the data we are the controller for. It is deliberately small.

• Account details: your name, work email address, and the password hash held by our authentication provider. We never see your password.
• Workspace details: your agency name, the workspace you belong to, and your role in it, which is what the database uses to decide what you can read and write.
• Billing details: your plan, your billing status, and the invoice history. Card details are handled by the payment provider and are never stored by us.
• Product usage: which features you use, credit consumption on the AI features, and the audit trail of significant actions in your workspace.
• Support correspondence: emails you send us and our replies.
• Technical logs: request logs and error reports generated by our hosting and database providers, which include IP address and browser user agent, and which we use to keep the service running and to investigate faults.

What passes through Pulse about candidates and clients

This is the data you are the controller for. What is in it is your choice, because you type it or import it.

In normal use it includes candidate names, contact details, work history, CVs and documents you upload, notes your team writes, pipeline stage and activity history, and the same kind of record for your client contacts.

Where you use the enrichment feature, contact details may be returned by an enrichment provider rather than typed by you. Where you use the AI features, the content of the records the question touches is sent to the model provider in order to answer it. Both are named under sub-processors below.

Where a member adds candidates from their CVs, Pulse reads each CV and lists what it states, each detail quoting the words it came from, and the member confirms, edits or drops every one before anything is saved. The model is told never to record a person's age, family, health, religion, nationality, ethnicity, sexuality or gender, and a filter drops anything that does. A CV nobody added is deleted within seven days. A CV sent through a role's application link is read the same way when it arrives, and waits for a member to confirm it.

The text of every CV and document Pulse can read is kept with its file so your team can search it, and it is deleted when the file or the person is.

Where a member connects their own Fireflies notetaker, Pulse reads the meetings it recorded for them: the title, time, attendees' email addresses and the summary. When that member asks Pulse to suggest details from a meeting, or to draft an interview scorecard from one, its transcript is fetched and sent to the model provider for that one read and is not stored. Pulse keeps only the words each suggestion or draft quotes, nothing is added to a record until the member approves it, and a draft never carries a score. Each member can turn transcript reading off.

Where you use the browser extension, a person's name, headline and employer can be captured from the LinkedIn profile you are looking at, at the moment you press Add to campaign. That is the only thing the extension writes, and the section on it below sets out exactly what it reads and when.

We do not use your candidate or client records to train models, to build a shared database, or to market to the people in them. They exist to serve your workspace and nothing else.

Why we process it, and the legal bases

For the account data we control, these are the grounds we rely on under the UK GDPR and the EU GDPR.

• Performance of a contract: creating your account, running your workspace, providing support, and taking payment. Without this data there is no service to provide.
• Legitimate interests: keeping the service secure, preventing abuse, investigating faults, and understanding which features are used so we can improve them. We use the least data that answers the question.
• Legal obligation: keeping billing and tax records for the period the law requires.
• Consent: only where we ask for it explicitly, for example before sending product email you can opt out of. You can withdraw consent at any time and it does not affect anything done before you withdrew it.
• For candidate and client records, the legal basis is yours to establish as the controller, and it is usually legitimate interests in a recruitment context or the consent you collected. We process those records on your documented instructions.

Sub-processors: the whole list

These are the third parties that process data for us. This is the complete list as at the date at the top of this page, not a sample of it. We will update this page before adding a new one.

• Supabase: the database, authentication and file storage behind the product. It holds your workspace data, in the London region.
• Vercel: application hosting and the edge network the site runs on. It processes request data and technical logs.
• OpenAI: the model behind the AI features. It receives the content of the records a question touches, at the moment you ask a question, and only then. When a member asks Pulse to suggest details from a meeting or to draft a scorecard from one, it also receives that meeting's transcript or summary, for that one read, and when a member adds candidates from their CVs, the text of each CV.
• Anthropic: an alternative model for writing posts, used only when you choose one of its models in the content writer. It receives what that request carries, at the moment you make it.
• PDF.co: reads a scanned CV, or an old Word file, when a member adds candidates from their CVs and Pulse cannot read the file itself. It receives that one file through a link that works for one minute, processes it in the United States, and is asked to keep nothing: what it returns expires within a minute and is deleted once read.
• Fireflies: the meeting notetaker a member connects with their own account. Pulse reads from it the meetings it recorded for that member, and their transcripts only when the member asks Pulse to suggest details or draft a scorecard from one. The recordings stay in Fireflies.
• Exa: web research behind the BD research feature. It receives the search query, not your candidate records.
• Prospeo: contact enrichment, and company search behind market building. It receives the identifying details needed to look a person up when you run an enrichment, and the search criteria, never your records, when a market is built.
• Unipile: LinkedIn account connection and posting. It receives the LinkedIn account authorisation and the content you choose to publish.
• ZeroBounce: email verification. It receives an email address before we send to it, so a message does not bounce and damage your sending reputation.
• PredictLeads: company signals for the companies you track, and company discovery behind market building. It receives the company, and the seed companies you name when a market is built, not your candidate records.
• BlitzAPI: people and company data, the first source for keeping candidate records current, contact enrichment, sourcing and market building. It receives a person's LinkedIn profile address when their record is kept current or their contact details are looked up, and search criteria, never your records, when people or companies are searched.
• Apify: job and company page scraping, and keeping candidate records current. For scraping it receives the company or job page we are reading. To keep a candidate current it receives their LinkedIn profile address.
• Resend: the sender behind the emails Pulse itself sends you, such as a warning before records are deleted. It receives your own address and the message, never a candidate's details.
• PostHog: product analytics, so we can see which parts of Pulse are used. Session recordings mask every input and every piece of text, so a recording of your candidate board carries no names.
• Sentry: error monitoring. It receives the technical context of a failure.
• Whop: billing. It receives your account and payment details, and no candidate data at all.

The browser extension

The Pulse browser extension is an optional companion to the web app. It runs on LinkedIn while you work and it records the outreach you do yourself. It never performs an action on LinkedIn for you, never sends a message or a connection request on your behalf, and never sends a request to LinkedIn's servers.

It reads your existing Pulse session from a cookie on our own domain so that you do not have to sign in a second time. That session is read fresh on each request and is never stored by the extension, which is why signing out of Pulse on the web takes effect in the panel immediately.

The only thing it keeps on your machine is a queue of actions you recorded while offline, and that queue is emptied as soon as it can reach Pulse.

A person added this way is recorded as having come from the extension. That is deliberate: if somebody asks how you came to hold their details, the origin of the record is answerable rather than guessed at. You remain the data controller for them, exactly as you are for anyone you type in or import.

What it reads from a LinkedIn page, and at which moment:

• The address of the profile you are looking at, when you open the panel, and only then. It is used to ask whether that person is already in one of your campaigns. Nothing is written to your workspace by that question, and the address is sent in a way that keeps it out of our request logs as well, so no record of the profiles you have viewed exists anywhere in Pulse.
• The name, headline and employer shown on the profile, and only at the moment you press Add to campaign. That press is the only thing that writes a person into your workspace, and it captures those three fields and nothing else.
• The actions you tell it you have taken, such as sending a connection request or a message, together with any note you write against a call. These become the activity history against that person in your workspace.

Google and Microsoft accounts you connect

You can sign in with a Google or Microsoft account, or connect one from Settings. When you do, you are asked once, on Google's or Microsoft's own screen, to let Pulse read and write your calendar. Pulse keeps an encrypted access token for that account so it can work with it for you without asking again. This connection never gives Pulse your email: mail you connect for outreach goes through Unipile, listed above, under its own permission.

What Pulse does with the connection:

• Your calendar: Pulse shows it inside the product, creates, changes and cancels the meetings you ask it to, adds a Google Meet or Microsoft Teams link to meetings you create, and reminds you before them. It keeps a copy of your events from 90 days ago to a year ahead so the calendar loads quickly, and that copy is visible to you alone.
• The people in your meetings: an attendee's email address is compared with the candidates and contacts already in your workspace, so a meeting shows who it is with and links to their record. Nobody is added to your workspace from your calendar.

What Pulse never does with a connected account

Pulse does not sell data from your Google or Microsoft account, does not use it for advertising, and does not use it to train AI models, ours or anyone else's. It shares it only with the sub-processors listed above that are needed to run the feature you are using. Nobody at Pulse reads it, except with your permission when you ask for support, when it is needed for security, or when the law requires it.

Pulse's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

You decide what colleagues in your workspace see of your calendar: nothing, when you are busy (the default), or also the titles, places and meeting links of your events. A colleague sees it only if they choose to follow your calendar. Nobody but you ever sees who is invited, or what an event says, admins included; an admin can see only whether your connection is working.

To stop it, disconnect the account in Settings, under Accounts. Pulse deletes its token and its copy of your calendar straight away, and asks Google to revoke its access. You can also remove Pulse from your Google account at myaccount.google.com/permissions, or from your Microsoft account at account.microsoft.com, and Pulse stops working with the account the next time it tries.

Where your data is kept, and international transfers

Your workspace data is stored and processed in eu-west-2, the London region, in a database project dedicated to Pulse and shared with no other product. We do not offer a choice of region today, so if your policy requires a particular one, say so before you start a pilot rather than after.

Some of the sub-processors named above operate outside the United Kingdom, and the AI, research and enrichment features send data to them when you use those features. Where that happens, the transfer is covered by the standard contractual clauses and equivalent safeguards in those providers' data processing terms.

If you would rather no data left the United Kingdom at all, the AI, research, enrichment and LinkedIn features are the ones to leave switched off. The core ATS does not depend on them.

Security

Every connection to Pulse runs over TLS 1.2 or better. There is no unencrypted route into the product.

Data at rest is encrypted with AES-256 by our database and storage provider, including automated backups.

Integration credentials and API keys you paste in are encrypted before they are stored, and they are never sent to the browser.

Access is enforced in the database rather than only in the interface. Every table carries a row-level security policy scoped to workspace membership, checked on every read and every write, so a bug in a screen cannot return another agency's records.

Inside RecruiterGTM, production data access is limited to the engineer who maintains the platform, is used only to investigate a fault you have reported, and is not used for support browsing.

We hold no security certifications today and we have not commissioned an independent penetration test. We would rather say that than imply an audit we have not had. The security page tracks what is held, in progress and planned.

How long we keep things

Your workspace data lives for as long as your workspace does, unless you tell us otherwise. We set no retention period on your behalf: a candidate you sourced two years ago is often the placement you make this quarter, and a default that quietly deleted your pipeline would be a decision we made about your business without asking.

You can set one, in Settings, Privacy. Choose how long to keep people you never placed, and how long after consent lapses, and we apply it. Nothing is deleted without warning: we email every admin a week before and again the day before, and either of them can keep the whole group for another full period with one click. Placed candidates are never included, because the placement record has to survive for the contract.

When you cancel, your data stays available for export for at least 30 days. After that we delete the workspace and its records. Deletion is carried out by a person today rather than by an automated job, so if you want it done on a specific date, tell us and we will confirm when it is done. If you ask us to delete it sooner, we will.

Billing and tax records are kept for the period UK law requires, which is currently six years, and they are kept separately from your workspace data.

Technical logs are held on a rolling short window by our hosting and database providers and are not retained long term.

Deciding how long to keep an individual candidate record is a controller decision, which makes it yours. You can delete any record at any time and it is removed from the database, not hidden.

Your rights, and how to use them

If you are a Pulse customer, you have the following rights over the account data we control. If you are a candidate whose record sits in an agency's workspace, you have the same rights, and you exercise them against that agency because they are the controller. Ask us and we will tell you which agency holds you and pass your request on.

We build the agency's side of this rather than leaving them to it. An agency can export everything held about one person as a file they can send you, and erase you from their workspace, from the record itself and in one action. So when you ask them, the answer does not depend on whether they have somebody technical available.

Two things survive an erasure, and both are deliberate. A placement and its invoice stay, with your name removed from them, because the law requires a financial record to be kept. Your email address stays on a suppression list, so that nobody can import you again and contact you by mistake. That second one is the only way an erasure and an objection can both be honoured, and an agency erasing you is shown both before they confirm.

• Access: ask what we hold about you and get a copy of it, including where each detail came from.
• Rectification: have anything inaccurate corrected. Most account fields you can edit yourself in settings.
• Erasure: ask for your account and workspace to be deleted. We will do it within 30 days unless the law requires us to keep a specific record, such as an invoice, and we will tell you if that applies. A candidate asks the agency, who can do it immediately.
• Portability: get your candidates, clients and history in a machine-readable export, at any time, including after you cancel. This is a product feature, not a request queue.
• Objection: object to processing we base on legitimate interests, and we will stop unless we have grounds that override yours.
• Restriction: ask us to pause processing while a dispute about accuracy or grounds is resolved.
• Withdraw consent: where we relied on consent, take it back at any time.

How to make a request, and how to complain

Write to operations@recruitergtm.com. Say what you want and enough for us to identify you. We answer within 30 days, and we will tell you if a request is genuinely complicated enough to need longer.

There is no charge for a request unless it is repetitive or excessive, in which case we will tell you the reason before doing anything.

If you are not satisfied with how we handled it, you can complain to the Information Commissioner's Office in the United Kingdom, at ico.org.uk, or to your local supervisory authority in the European Union. We would rather you came to us first so we get the chance to fix it.

Cookies

Pulse uses authentication cookies to keep you signed in and nothing else. There is no analytics tracking and no advertising tracking. The detail is on the cookie policy page, which is a separate document because cookies are separately regulated.

Automated decision-making

Pulse produces a fit score. When a recruiter asks for an assessment against a role, a model reads the candidate's record and the role's criteria and returns a number from 0 to 100, with its reasoning against each criterion and the name of the model that produced it. We say so plainly because the score exists and a candidate is entitled to know it does.

It is a starting point for a person, not a decision. Nothing in Pulse advances, rejects or filters anybody on the strength of that number: there is no threshold that acts on its own, no automatic rejection, and no stage a candidate moves through without a recruiter choosing to move them. The score is shown alongside its reasoning precisely so it can be disagreed with, and a recruiter who ignores it entirely uses the product normally.

So we do not consider this automated decision-making with legal or similarly significant effects, because the deciding is done by a person who can see what the model said and why. If you want to know how you were assessed, ask the agency holding your record: they can show you the score, the reasoning and the model, and they can correct or remove it.

Interview scorecards are written and scored by people. An interviewer can ask Pulse to draft the written answers from their own recorded meeting with the candidate, and edits them; no model gives a star or a verdict, and the prompt that drafts them has no place for one.

Children

Pulse is a business tool sold to recruitment agencies and it is not directed at children. We do not knowingly collect data from anyone under 16 through the product itself.

Changes to this policy

When this policy changes, the date at the top changes and the version history at the bottom records what changed. For a change that materially affects you, we will email account holders rather than relying on you noticing.

Legal and privacy enquiries

Questions about this document, a data request, or anything else legal: write to us and a person will answer.

Email operations@recruitergtm.com. This document has been written to be clear and accurate, and it has not been reviewed by a lawyer.