Privacy Policy

Scout ("we", "us", "our") is the data controller for personal data collected through this platform. Our database is hosted in the European Union (Supabase, EU region).

For data protection enquiries, contact: privacy@scoutjobs.eu.

Candidates: name, email address, phone number (if you provide one), location, work history, education, skills, languages, certifications, self-declared working rights, CV and cover-letter files, and any other information you add to your profile or an application.

Recruiters: name, email address, company name, seat role and team membership, billing information (processed by Stripe — we do not store card details), and job postings.

All users: authentication data, session information, usage logs, and IP address and browser/device information — for example, captured when you accept our Terms and Conditions (kept as a dated consent record), or as part of ordinary security and fraud-prevention logging.

View analytics: when you view a job listing, or a recruiter views your candidate profile, we log a minimal record — an anonymous session identifier or your account identifier, plus a timestamp — to power the view-count analytics shown to employers.

We use your data to provide the Scout service: matching candidates with job opportunities, enabling recruiters to review applications, showing employers analytics about their own listings, and processing subscription payments.

We do not sell your personal data to third parties, and we do not currently send marketing or promotional communications. If that changes, we will only do so with your consent and with an easy way to opt out.

When you apply for a job, Scout may use AI to help the employer assess applications. This includes generating a fit score and written summary of your application against the role's requirements, and comparing applications to a role side by side. This is profiling within the meaning of GDPR Art. 4(4), and — because it evaluates job candidates — the underlying AI system may also fall within scope of the EU AI Act's rules for recruitment-related AI.

These outputs are decision support for a human recruiter, who reads them and decides. We do not make hiring decisions by automated means alone, so Art. 22 (solely automated decision-making) does not apply. AI output is visible only to the employer you applied to; it is never shown publicly.

Application content is sent to our AI provider (Anthropic) to generate these outputs. You may object to profiling based on legitimate interests — contact us at privacy@scoutjobs.eu.

Identity verification is optional. If you choose to verify, the check is performed by Veriff (Veriff OÜ, Estonia).

Scout never receives or stores your identity document. Your document images, selfie, and any biometric data are captured by Veriff directly through their own secure flow and are held by Veriff, not by us. We receive only the outcome and a minimal set of fields: whether the check passed, the document type, issuing country and expiry date, a session reference, and a reason code where a check did not pass. We do not store your document number, date of birth, address, or any face-match or biometric score.

Veriff's role. Veriff acts as our processor for performing the check, and additionally as an independent controller for fraud prevention purposes, for which it determines its own purposes and retention.

Where the data is held. Veriff stores verification data on EU infrastructure (AWS, Ireland). Please note that "stored in the EU" is not the same as "never leaves the EU": some processing may take place outside the EU under appropriate safeguards (Standard Contractual Clauses).

Retention. Veriff retains verification sessions for a limited period (currently six months by default). Some fraud-prevention and biometric data is subject to Veriff's own statutory retention obligations as an independent controller and is not deleted when you delete your Scout account. Where you ask us to erase your data, we file a deletion request with Veriff through their dedicated process, but we cannot override retention they are legally required to apply.

Identity is not work authorisation. A verified badge on Scout means your identity document was authenticated. It does not mean we have verified your right to work in any country. Working rights shown on your profile are self-declared by you and are not verified by Scout or by Veriff.

Veriff's data-processing terms and current sub-processor list are published at veriff.com/documents.

Contract performance (Art. 6(1)(b)) — processing necessary to provide the service you signed up for, including submitting your application to an employer.

Consent (Art. 6(1)(a)) — identity verification, which is optional and which you may decline without losing access to the rest of Scout.

Legitimate interests (Art. 6(1)(f)) — fraud prevention, platform security, service improvement, view-count analytics shown to employers, and AI-assisted application assessment for the employer you applied to.

Legal obligation (Art. 6(1)(c)) — retaining billing records as required by applicable law.

Our primary database, authentication, and file storage (Supabase) run in the EU, as does our email provider (Resend) and our search index (Typesense, Frankfurt). Some providers we rely on — including Stripe (payments), Anthropic (AI processing), and Vercel (hosting) — are based outside the EU or operate global infrastructure, and may process personal data outside the European Economic Area.

Where that happens, we rely on Standard Contractual Clauses or another safeguard recognised under GDPR Chapter V as the legal basis for the transfer. Veriff's transfer arrangements are described separately in section 5.

Candidate profile data is retained for as long as your account is active. You may request deletion at any time (see Your Rights below). As a general principle, we keep personal data only for as long as necessary for the purpose it was collected for, or as required by law.

Billing records are retained for the period required by applicable tax law (typically 7 years).
Consent records (acceptance of our Terms and Conditions or this Policy) are retained as our record of your consent history; when you delete your account, these records are anonymised — your identifier is removed — rather than deleted outright, so the audit trail survives independently of you.
View analytics (job views and candidate-profile views, see section 2) are kept to power employer-facing analytics. We do not currently run an automated process to delete these after a fixed period, so historical records may persist for longer than other categories of data until one is built.
Identity-verification data held by Veriff is subject to their retention periods, described in section 5.

We apply reasonable technical and organisational measures to protect your data, including database-level row-level security policies that restrict data access to what each user or role is actually authorised to see, encrypted connections (TLS) for data in transit, and encryption at rest provided by our infrastructure providers. Internal access to personal data is limited to what is needed to operate and support the platform.

No system is completely secure, and we cannot guarantee absolute security.

Under GDPR, you have the right to: access your personal data, correct inaccurate data, request erasure ("right to be forgotten"), data portability, object to processing based on legitimate interests (including the profiling described in section 4), and withdraw consent for identity verification.

To exercise any of these rights, email privacy@scoutjobs.eu. We will respond within one month of your request, extendable by a further two months for complex requests as GDPR allows. Where data is held by a third party acting as an independent controller (see section 5), we will pass your request on, but their own legal retention obligations may apply.

Scout is not directed at children and is not intended for use by anyone under 18, consistent with the eligibility requirement in our Terms and Conditions. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at privacy@scoutjobs.eu and we will delete it.

We use strictly necessary cookies for authentication and session management. See our Cookie Policy for details.

We use the following providers under data processing agreements. Those marked EU host your data inside the European Union; see section 7 for how we safeguard the transfers that aren't.

Supabase (EU) — database, authentication, and file storage.
Vercel — application hosting and delivery.
Stripe — payment processing for employer subscriptions.
Resend (EU) — transactional email.
Veriff (EU) — optional identity verification; also an independent controller for fraud prevention (see section 5).
Anthropic — AI processing of application content (see section 4).
Typesense, hosted on Fly.io (EU, Frankfurt) — job search indexing. Job listings only; no candidate data.
Inngest — background job processing.
Applicant tracking systems (ATS) — where an employer connects Scout to their own recruiting software, your application data (including your CV) is sent to that system so the employer can process it there. We integrate with a growing number of ATS providers, so we describe this as a category rather than naming each one here; the specific system is shown to you before you apply where it applies to that role, and the receiving employer's own privacy practices govern data once it reaches their system.

For privacy concerns or to exercise your rights: privacy@scoutjobs.eu.

You also have the right to lodge a complaint with your national data protection authority.