Privacy Policy

Effective date: March 9, 2026 Last updated: October 22, 2026

Reqcore, Inc. ("Reqcore," "we," "us," or "our") operates the Reqcore applicant tracking system available at https://reqcore.com (the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have.

If you have questions about this policy, contact us at privacy@reqcore.com.

1. Scope

This policy applies to:

• Visitors to reqcore.com and its subdomains
• Candidates who apply to jobs through the public job board
• Registered users (recruiters, hiring managers, administrators) who operate the Service
• Self-hosted instances only insofar as their operator deliberately connects them to a Reqcore-operated service

Self-hosted deployments operate on your infrastructure, and Reqcore has no access to the data stored in them. The published self-hosted image contains no analytics and sends nothing to Reqcore. It makes outbound connections only to services the operator configures — such as a mail server, an AI provider, a calendar or a single sign-on provider — plus a version check against GitHub's public release API. Setting OFFLINE_MODE=true disables the version check, analytics and lifecycle email, and reqcorectl doctor reports the instance's outbound posture so the operator can verify it on their own system.

2. Data We Collect

2.1 Account Data

When you create an account, we collect:

2.2 Candidate Application Data

When a candidate submits an application through the public job board, the organization operating the job board is the data controller for that application data. Reqcore acts as a data processor. Application data may include:

• Name, email, phone number
• Resume / CV and cover letter
• Responses to custom application questions
• Any files uploaded during the application process

For self-hosted deployments, all of this remains on the operator's infrastructure and Reqcore never sees it.

For the hosted service at reqcore.com, this data is stored in infrastructure Reqcore operates on the organization's behalf (see §6 for the sub-processors involved) and is processed only on the organization's instructions. Reqcore does not use it for its own purposes, does not sell it, and does not use it to train AI models.

It is shared beyond Reqcore's own infrastructure in three cases, all on the organization's instruction:

• AI screening and the AI assistant — if the organization enables them. See §2.5.
• Candidate communication — email sent to the candidate goes through our email provider.
• Interview scheduling — if the organization connects a calendar, the candidate's name and email are added to the calendar event as an attendee, and the calendar provider sends its own invitation email.

2.3 Analytics Data

We use PostHog (EU instance: eu.i.posthog.com) for product analytics on the hosted version at reqcore.com. Analytics data is collected only after you grant explicit consent via the cookie banner.

What we collect when you opt in:

Data minimisation: Only user IDs (opaque UUIDs) are sent — not names, email addresses, or account creation dates. URL query parameters and fragments are stripped from all captured URLs before transmission to prevent accidental token or PII leakage.

What we do NOT collect:

• Your name, email address, or any directly identifying personal data
• Session recordings
• Autocapture / DOM interaction tracking
• Console logs
• Form inputs or keystrokes
• Survey responses
• Candidate application content
• URL query parameters or fragments (stripped before capture)

PostHog is configured with the following privacy settings:

• opt_out_capturing_by_default: true — Nothing is captured, and nothing is written to your device, until you accept. Declining opts out explicitly and clears anything stored during the visit.
• autocapture: false — No automatic click/form/input tracking
• disable_session_recording: true — No screen recordings
• disable_surveys: true — No in-product surveys
• property_denylist: ['$ip', '$initial_ip'] — Your IP address is dropped from events
• person_profiles: 'identified_only' — No profile is created for anonymous visitors
• secure_cookie: true — Cookies are only transmitted over HTTPS

Two notes in the interest of being exact:

• Do Not Track is not honored (respect_dnt: false). Because nothing is captured before you accept the banner, the DNT signal would only affect visitors who have already given explicit consent, and we treat that consent as the more specific instruction.
• Cross-subdomain cookies are used after you accept (cross_subdomain_cookie: true), so your consent and analytics identity carry between reqcore.com and app.reqcore.com rather than asking you twice.

2.4 Technical Data

Our servers automatically log:

• IP addresses, in memory, for rate limiting and abuse prevention. When a rate limit is exceeded we record a keyed one-way hash of the address, never the address itself.
• HTTP request metadata (method, path, status code, user agent, response time)

Request logs for the authenticated application are forwarded to PostHog (EU) for operational monitoring. Requests to public candidate-facing routes are excluded — a candidate applying for a job is not a user of ours, has no account, and is never offered a consent choice, so their requests are not logged to a third party.

These logs are used for security and reliability monitoring and are rotated regularly.

2.5 AI Processing of Application Data

Organizations can enable two optional AI features. Both are off by default and are the organization's decision, not ours:

• AI screening — when an organization turns this on for a role, each application submitted to that role is sent to a large language model to be scored against the criteria the organization defined. The prompt contains the resume text, cover letter and screening answers. Candidates are told this on the application form before they submit.
• AI assistant — a chat assistant recruiters can ask about candidates. It can read candidate records and document text. It is not given a candidate's gender or date of birth.

What you should know about this processing:

• The model providers are outside the EU/EEA. Depending on the organization's configuration this is OpenAI, Anthropic, Google, OpenRouter, or an endpoint the organization supplies itself. Organizations that need EU-only processing can configure their own EU-hosted, OpenAI-compatible endpoint.
• AI output is a ranking aid, not a decision. A score does not by itself reject an application. Rules an organization configures can move an application's status automatically; the organization is responsible for the human oversight around that, and a candidate can ask them for a human review or object to the automated analysis.
• We do not train models on your data. Reqcore does not, and platform-funded analysis runs through providers on terms that do not train on submitted content. An organization using its own API key is subject to the terms it agreed with that provider.
• Prompt and completion content is never sent to our observability tooling — only token counts, latency and cost.

3. Cookies and Local Storage

Reqcore uses a minimal set of cookies and local storage entries:

Nothing in the "only set after consent" rows is loaded, requested, or stored before you make a choice. If you decline, or simply never answer the banner, no request is made to PostHog or to Google.

We do not sell or rent personal data to third parties.

4. How We Use Your Data

We use personal data for the following purposes:

1. Provide the Service — Authenticate users, manage organizations, process job applications
2. Improve the Service — Analyze aggregated usage patterns to prioritize features (analytics, opt-in only)
3. Security — Rate limiting, abuse prevention, audit logging
4. Communication — Account-related emails (password resets, critical security notices)
5. Legal compliance — Respond to lawful requests from authorities
6. Advertising measurement — If, and only if, you accept analytics cookies, we use Google Ads and Google Analytics to measure which campaigns lead to signups and to build remarketing audiences. This applies to visitors and prospective customers on our marketing site and signup flow. It is never applied to candidate application data.

We do not:

• Sell or rent personal data to third parties
• Advertise to, target, or build remarketing audiences from candidates who apply for jobs
• Load any advertising or analytics tag before you consent
• Make decisions producing legal or similarly significant effects about you by automated means alone. Organizations can configure their own rules that act on an application automatically; where they do, candidates are told on the application form and can ask the organization for a human review (see §2.5)
• Train AI or machine-learning models on your data

5. Legal Bases for Processing (GDPR)

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, we process personal data under these legal bases:

6. Data Sharing and Sub-processors

We share personal data only with the service providers below. This is the complete list for the hosted service; self-hosted deployments use whichever of these the operator configures.

6.1 Always in use

6.2 In use only if you consent

6.3 In use only if your organization enables the feature

Our marketing site additionally uses Endorsely (affiliate referral tracking, consent-gated), Cal.com (demo booking — you enter your own details) and giscus (documentation comments via your GitHub identity).

We do not sell, rent, or trade personal data. Data is shared with sub-processors only as necessary to operate the Service.

6.4 International Transfers

Reqcore, Inc. is a US company and several sub-processors above are outside the EEA. For transfers from the EEA we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914), supplemented by the technical measures described in §9 — in particular that CVs and documents are encrypted in transit, are never exposed through public URLs, and are only accessible through authenticated, tenant-scoped requests.

Customers who need a copy of the transfer documentation, or a transfer impact assessment for their own records, can request one at privacy@reqcore.com.

Organizations that need candidate data to stay within the EU/EEA can configure their own EU-hosted AI endpoint (§2.5); the application, database and object storage regions are set per deployment — contact us before signing if this is a requirement.

7. Data Retention

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

8.1 GDPR Rights (EEA, UK, Switzerland)

• Access — Request a copy of your personal data
• Rectification — Correct inaccurate data
• Erasure — Request deletion of your data ("right to be forgotten")
• Restriction — Limit how we process your data
• Portability — Receive your data in a structured, machine-readable format
• Objection — Object to processing based on legitimate interest
• Withdraw consent — Revoke analytics consent at any time via the cookie banner or by clearing local storage

To exercise these rights, contact privacy@reqcore.com. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. In Norway this is Datatilsynet (datatilsynet.no), Postboks 458 Sentrum, 0105 Oslo. If you are elsewhere in the EEA, you may complain to your own national authority.

If you are a candidate, note that the organization you applied to is the controller of your application data. Requests for access, correction or deletion of an application are best sent to them directly — the contact address is on the application form. If you cannot reach them, contact us at privacy@reqcore.com and we will route the request and tell you who the controller is.

8.2 California Privacy Rights (CCPA, as amended by the CPRA)

If you are a California resident, you have the right to:

• Know and access — what personal information we collect, the sources, the purposes, and who we disclose it to (§2, §4 and §6 describe each), and a copy of it
• Correct inaccurate personal information
• Delete your personal information
• Opt out of the sale or sharing of your personal information
• Limit the use of sensitive personal information
• Non-discrimination for exercising any of these rights

Sale and sharing. We do not sell personal information. California law also treats making personal information available for cross-context behavioral advertising as "sharing," even when no money changes hands. The only activity of ours that can qualify is Google Ads remarketing on our marketing site and signup flow (§4), and it runs only if you opt in through the cookie banner. Declining, or withdrawing your choice in the banner at any time, opts you out. Candidate application data is never sold or shared.

Sensitive personal information. We use sensitive personal information, such as account login credentials, only to provide the Service and keep it secure, and never to infer characteristics about you.

To exercise these rights, contact privacy@reqcore.com. We may need to verify your identity before acting on a request, and you may use an authorized agent to make a request on your behalf. We respond within 45 days.

If you are a candidate, the organization you applied to controls your application data. Send requests about an application to them first; if you cannot reach them, contact us and we will route the request.

9. Security

We implement appropriate technical and organizational measures to protect personal data, including:

• HTTPS-only connections with HSTS
• HTTP-only, secure session cookies
• Server-side session storage
• Tenant-isolated database queries
• Rate limiting on public endpoints
• Schema validation (Zod) of API request input
• Proxied document access (no direct S3/MinIO URLs exposed)

The security measures above summarize the current controls used to protect personal data.

10. Children's Privacy

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@reqcore.com and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or via email. The "Last updated" date at the top of this page indicates when the policy was most recently revised.

12. Contact

For privacy-related inquiries:

• Email: privacy@reqcore.com

If you are in the EEA and believe we have not adequately addressed your concerns, you may contact your national supervisory authority — in Norway, Datatilsynet (datatilsynet.no).