Kandu Privacy Policy (English)

Who we are

Kandu is a recruiting tool for small and medium-sized businesses, provided by Antonio Bernabé, a self-employed professional in Spain, under the trade name Kandu (“Kandu”, “we”). Website: https://kandu.work. Application: https://app.kandu.work. Contact for any privacy matter: privacidad@kandu.work. This English version is provided for convenience; the Spanish version is also available at https://kandu.work/legal/privacidad.

Scope

This policy covers the website kandu.work, the web application app.kandu.work and our support chat. It explains how we collect, use, store and share the personal data of our business customers and their users, of people who contact us and of website visitors. Candidate data that our customers manage in Kandu is described in its own section below.

How Kandu uses Google user data

Kandu offers an optional Google Calendar integration. This section describes exactly which Google user data Kandu accesses and how Kandu uses, stores, shares and deletes it. It applies to all data Kandu receives through Google APIs.

Data we access. Only if a user clicks “Connect Google Calendar” in Kandu and grants permission on Google’s consent screen, Kandu receives: (1) the user’s email address (scopes openid and https://www.googleapis.com/auth/userinfo.email); and (2) permission to create and manage events in the user’s own calendar (scope https://www.googleapis.com/auth/calendar.events). Kandu does not request access to Gmail, Contacts, Drive or any other Google data.

How we use it. Kandu uses the calendar.events permission only to: add to the user’s Google Calendar the job interviews and trial days that the user schedules in Kandu; update those events when the user changes their date, time or interviewer; delete them when the user cancels them; and, if the user chooses, add a Google Meet link to them. Kandu does not read, list, copy or analyse any other event in the user’s calendar. The email address is used only to show the user which Google account is connected. Google user data is used only to provide this feature to the user who connected it, and never for advertising, profiling or any other purpose.

How we store and protect it. Kandu stores only the OAuth refresh token, the connected email address and the IDs of the events that Kandu itself created. They are kept in our database in the European Union (Supabase, Paris), encrypted in transit and at rest, and accessible only to Kandu’s backend service. Kandu staff do not read this data, except when the user asks us for support and gives permission, when it is necessary for security, or when required by law.

How we share it. Kandu does not sell Google user data and does not share it with third parties, except the infrastructure providers that host our service under a data processing agreement (Supabase and Hostinger), or when required by law. Kandu does not use Google user data to develop, improve or train generalized artificial-intelligence or machine-learning models, and does not send it to any AI service.

How long we keep it and how to delete it. The token and the connected email address are deleted immediately when the user clicks “Disconnect” in Kandu, when the user revokes access at https://myaccount.google.com/permissions, or when the user’s Kandu account is deleted. The events already created remain in the user’s own calendar, where the user can delete them. Users can also ask for deletion at any time by writing to privacidad@kandu.work.

Limited Use. Kandu’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Data we collect and why

Account data: name, email address, password (stored hashed; nobody at Kandu can see it), company, role in the team and preferences, used to create and run the account. Usage data: an activity log (which action was taken, by whom and when), used to provide the service, give support and keep it secure. Billing data: company name, tax ID, address, plan and invoices, used to invoice and meet tax obligations. Card payments are handled by Stripe; Kandu never sees or stores card numbers. Support data: the messages you send through the support chat, email or contact form, and your name and email if you give them, used to answer you. The support chat is first answered by an automated AI assistant with information about Kandu; if it cannot help or you ask for it, a person from our team takes over. Technical data: IP address, date and browser of each request in our server logs, used for security and troubleshooting and deleted within a few weeks.

Candidate data

Businesses use Kandu to manage the job applications they receive. For that data the business is the controller and Kandu is the processor, under our Data Processing Agreement: we process it only to provide the service to that business and following its instructions. It includes what the candidate submits in the application form (contact details, answers, CV and, optionally, a short video), their town or postcode to calculate the distance to the workplace, and the notes and decisions of the business’s team. CVs are read automatically by an AI provider to organise experience, education, licences and languages in the candidate’s record; this is never used to score, rank or reject anyone, and all decisions are made by the business. Candidates can exercise their rights with the business they applied to, or write to us and we will forward the request.

Legal bases

Performance of the contract with the business customer and giving access to its users (Art. 6(1)(b) GDPR); compliance with legal obligations such as tax and accounting (Art. 6(1)(c)); our legitimate interest in answering enquiries, giving support, keeping the service secure and improving it (Art. 6(1)(f)); and your consent where we ask for it, for example to publish a review or to connect Google Calendar (Art. 6(1)(a)), which you can withdraw at any time.

How long we keep data

Account data: while the account exists. After cancellation, the business can export its data for 30 days, after which it is deleted, including backups. Invoices and tax data: six years, as required by law. Support conversations: two years. Server logs: a few weeks. Candidate data: as configured by each business (6, 12 or 24 months after the process closes), then deleted automatically. Google tokens: until disconnection or revocation, as described above.

Service providers

Only those needed to run the service, all under data processing agreements: Supabase (database, authentication and file storage; servers in Paris, EU); Hostinger (servers that run the website and the application); Purelymail (kandu.work email and notification emails); Anthropic (automatic CV reading and the support-chat assistant; United States; does not use this data to train its models); Google (only when a user connects Google Calendar); Stripe (subscription payments, once card payments are enabled). To calculate distances from a postcode or a location the candidate chooses to share, we query OpenStreetMap (Nominatim) from our server without sending the person’s IP address. We may disclose data to public authorities when required by law. We never sell personal data.

International transfers

Anthropic and Google are based in the United States. These transfers rely on the safeguards of Chapter V GDPR: the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework. Only the minimum data needed for each task is sent.

Security

Encrypted connections (HTTPS), encryption at rest, separation of each business’s data, role-based permissions, activity logging and backups. Kandu staff only access a business’s workspace with its permission, to provide support.

Children

Kandu is a service for businesses and professionals. It is not directed to children under 16 and we do not knowingly process their data.

Your rights

You can request access, rectification, erasure, objection, restriction and portability of your data, and withdraw consent, by writing to privacidad@kandu.work. We will reply within one month. You can also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Changes

If we make significant changes, we will publish them here with the new date and, if they affect business customers, notify them by email before they apply.